CVE-2014-2225

Multiple cross-site request forgery CSRF vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create a new admin user via a request to api/add/admin; 2 have unspecified impact via a request to...

Ubiquiti Networks UniFi Cloud Key Firmware 0.6.1 Command Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authenticated Command Injection product: Ubiquiti Networks UniFi Cloud Key vulnerable version: Firmware v0.6.1 fixed version: Firmware v0.6.4 CVE number: impact: High...

Code injection

Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it...

Ubiquiti Networks UniFi 3.2.10 - CSRF Vulnerability

No description provided by source...

Ubiquiti Networks UniFi 3.2.10 Cross Site Request Forgery

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ----------------------- Product: Ubiquiti Networks UniFi Vendor URL: www.ubnt.com Type: Cross-Site Request Forgery CWE-353 Date found: 2015-03-19 Date published: 2016-02-23 CVSSv3 Score: 6.3...

Ubiquiti Networks UniFi 3.2.10 - Cross-Site Request Forgery

Exploit for hardware platform in category web applications 1. ADVISORY INFORMATION ----------------------- Product: Ubiquiti Networks UniFi Vendor URL: www.ubnt.com Type: Cross-Site Request Forgery CWE-353 Date found: 2015-03-19 Date published: 2016-02-23 CVSSv3 Score: 6.3...

Cross site scripting

The default Flash cross-domain policy crossdomain.xml in Ubiquiti Networks UniFi Video formerly AirVision aka AirVision Controller before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file...

CVE-2013-3572

UniFi Controller (Ubiquiti) 2.x before 2.3.5 is affected by an XSS in the administer interface. A crafted client hostname can cause remote attackers to inject arbitrary script/HTML, potentially exposing sensitive data or session hijacking when the payload is rendered. Root cause: insufficient inp...