3649 matches found
Code injection
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides ext...
CVE-2018-9070
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides ext...
CVE-2018-9070
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides ext...
CVE-2018-9070
The CVE-2018-9070 flaw affects Lenovo Smart Assistant Android app versions
CVE-2018-9070: Undefined Security Weakness
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides ext...
Information Disclosure
moodle is affected by an information disclosure vulnerability. Hidden categories that should be omitted when fetching course categories can be retrieved from the corecoursegetcategories web service...
Design/Logic Flaw
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the corecoursegetcategories web service to return hidden categories, which should be omitted when fetching course categories...
CVE-2018-10890
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the corecoursegetcategories web service to return hidden categories, which should be omitted when fetching course categories...
PT-2018-10162
Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.5.1 Moodle versions prior to 3.4.4 Moodle versions prior to 3.3.7 Moodle versions prior to 3.1.13 Description A flaw was found that allows the core course get categories web service to return hidden categories, which...
CVE-2018-11641
Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service...
Hardcoded credentials
Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service...
CVE-2018-11641
Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service...
CVE-2018-11640
Affected product: Dialogic PowerMedia XMS (web service). Vulnerability: XML External Entity (XXE) injection in the web service. Versions affected: PowerMedia XMS before 3.5 SU2. Impact: remote attacker can read arbitrary files or cause denial of service (resource consumption). Severity: CVSS v3 b...
CVE-2018-7771
The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree...
CVE-2018-7772
The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter...
Directory traversal
The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree...
CVE-2018-7772
The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter...
CVE-2018-7771
The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree...
CVE-2018-11641: Use of Hard-coded Credentials
Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service...
PT-2018-18269
Name of the Vulnerable Software and Affected Versions: Schneider Electric U.motion Builder versions prior to 1.3.4 Description: The issue exists in the processing of applets exposed on the web service. It involves a SQL injection vulnerability in the underlying SQLite database query, which checks...