94 matches found
Code injection
LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...
Authentication flaw
LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...
CVE-2018-16287
LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs...
CVE-2018-16286
LG SuperSign CMS suffers an authentication bypass: if a captcha:pass cookie is present and the PIN is limited to four digits, CAPTCHA is skipped and access can be gained without proper authentication. Multiple sources (NVD/NVD-derived records and CNVD) describe this flaw and its impact; CVSS metr...
CVE-2018-16286
LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...
CVE-2018-16288
Affected product: LG SuperSign EZ CMS 2.5. Vulnerability: Local File Inclusion (LFI) in signEzUI/playlist/edit/upload/..%2f URIs allows reading arbitrary files on the device. The Nuclei template and Open Source disclosures confirm this LFI condition, with paths such as signEzUI/playlist/edit/uplo...
CVE-2018-16288
LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...
CVE-2018-16287
LG SuperSign CMS is affected by a file-upload vulnerability exploitable via signEzUI/playlist/edit/upload/..%2f URIs. The NVD entry CVE-2018-16287 documents a high-severity issue (CVSS v3.0: 9.8, Network attack, no authentication, no user interaction) leading to partial confidentiality, integrity...
CVE-2018-16706
CVE-2018-16706 affects LG SuperSign CMS. The issue allows remote reboot of TVs without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080. Root cause details are not elaborated in the provided documents beyond the reboot mechanism. Impact is high availability loss ...
CVE-2018-16706
LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsrserver/device/reboot on port 9080...
CVE-2018-16286: Improper Authentication
LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...
CVE-2018-16706: Direct Request
LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsrserver/device/reboot on port 9080...