Command injection

The Asus ZenFone 3 Ultra Android device with a build fingerprint of asus/WWPhone/ASUSA001:7.0/NRD90M/14.1010.1804.75-20180612:user/release-keys contains a pre-installed app with a package name of com.asus.splendidcommandagent app versionCode=1510200105, versionName=1.2.0.21180605 that allows othe...

CVE-2019-15400

Summary of CVE-2019-15400 (Asus ZenFone 3 Ultra): On devices with build fingerprint asus/WW_Phone/ASUS_A001:7.0/NRD90M/14.1010.1804.75-20180612:user/release-keys, a pre-installed app (com.asus.loguploaderproxy, versionCode 1570000020, versionName 7.0.0.4_170901) can be exploited by other pre-inst...

CVE-2019-15400

The Asus ZenFone 3 Ultra Android device with a build fingerprint of asus/WWPhone/ASUSA001:7.0/NRD90M/14.1010.1804.75-20180612:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-18931

Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer EIP control via crafted GET/POST parameters...

CVE-2019-18931

Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer EIP control via crafted GET/POST parameters...

CVE-2019-18930

Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users including guest account to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and downloadmgr.cgi makes it possible to enter large-sized...

Stack overflow

Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users including guest account to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and downloadmgr.cgi makes it possible to enter large-sized...

CVE-2019-18929

Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users including guest accounts to remotely execute arbitrary code via a downloadmgr.cgi stack-based buffer overflow...

CVE-2019-18929

The CVE-2019-18929 entry concerns Western Digital My Cloud EX2 Ultra firmware 2.31.183, where a stack-based buffer overflow in download_mgr.cgi allows remote code execution by web users (including guest accounts). Affected component: download_mgr.cgi on the WD My Cloud EX2 Ultra platform. Root ca...

CVE-2019-18930

Summary (CVE-2019-18930): Western Digital My Cloud EX2 Ultra firmware 2.31.183 is affected by a stack-based buffer overflow that allows remote code execution via web access. The flaw stems from missing size verification in a function within libscheddl.so and the handling of large f_idx inputs in ...

CVE-2019-18931

CVE-2019-18931 affects Western Digital My Cloud EX2 Ultra firmware up to 2.31.195. The issue is a buffer overflow that enables control of the Extended Instruction Pointer (EIP) via crafted GET/POST parameters. Affected firmware version is stated, but no remediation or patch version is provided in...

CVE-2019-18931

Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer EIP control via crafted GET/POST parameters...

Google's Ultra-Secure Chip, a Facebook Facelift, and More

Catch up on the most important news from today in two minutes or less...

Google Is Helping Design an Open Source, Ultra-Secure Chip

OpenTitan is a so-called secure enclave based on open source that could shake up hardware security...

How We Developed Our EQR Plugins

Extensible Analytics with EQR’s Lightweight, Ultra-Performance Plugin System I’ve written a few posts now on the plans and development of EQR Event Query Router, the open-source tool we built to give data scientists the ability to execute large-scale queries on real-time big data streams without...

Cross site request forgery (csrf)

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=packageaddnew to wp-admin/admin-ajax.php...

CVE-2015-9402

The CVE-2015-9402 entry concerns the WordPress plugin Users Ultra (and related variants) prior to version 1.5.59, where the uultra-form-cvs-form-conf component allows arbitrary file upload. This is documented across multiple connected records (NVD, RH/Red Hat, CVE lists, and WPVulndb), consistent...

CVE-2015-9395

The CVE-2015-9395 entry concerns the WordPress Users Ultra plugin (before version 1.5.64). The vulnerability is an SQL Injection via an AJAX action in this plugin. Public sources (NVD) report high impact with CVSS v3.1 metrics: Network attack vector, no user interaction, privileges required Low, ...

CVE-2015-9394

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=packageaddnew to wp-admin/admin-ajax.php...

CVE-2015-9394

The CVE concerns the WordPress plugin Users Ultra Membership (plugin) before 1.5.63. A CSRF vulnerability exists via action=package_add_new to wp-admin/admin-ajax.php, enabling an attacker to perform actions on behalf of authenticated users. Exploitation details are not provided beyond the CSRF d...