46 matches found
aloha-sd (>=1.0.0, <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (1.1.1)
dns-packet NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: SNYK:JS-DNSPACKET-1293563...
Design/Logic Flaw
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2021-3122
CVE-2021-3122 affects NCR Command Center Agent 16.3 on Aloha POS/BOH servers. The CMCAgent processes a runCommand parameter inside an XML document sent to port 8089, enabling remote unauthenticated execution of arbitrary commands as SYSTEM. Exploitation in the wild reported in 2020–2021. Vendor n...
CVE-2021-3122
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
shop.aloha-attitude.fr Cross Site Scripting vulnerability OBB-1233786
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
aloha-street.com Cross Site Scripting vulnerability OBB-1220002
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
aloha-street.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1172795 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques
During several recent incident response engagements, FireEye Mandiant investigators uncovered new tools in FIN7’s malware arsenal and kept pace as the global criminal operators attempted new evasion techniques. In this blog, we reveal two of FIN7’s new tools that we have called BOOSTWRITE and...
37fis (>=1.0.0, <=1.0.2), @alohahealth/aloha-react-sdk (>=0.1.5, <=0.1.9) +1328 more potentially affected by CVE-2018-1002204 via adm-zip (>=0.1.4, <=0.4.10)
adm-zip NPM version =0.1.4, =1.0.0, =0.1.5, =0.1.0, =0.7.0, =0.5.9, =1.10.1, =1.0.1, =0.1.28, =0.0.5, =2.5.1, =2.6.1 - @cr4zyc4t/phantom-html2pdf 1.0.3 - @cypress/core-example 0.3.1 and more Source cves: CVE-2018-1002204 Source advisory: OSV:GHSA-3V6H-HQM4-2RG6...
NCR Aloha POS SOAP API Detection
Binary data ncralohaposwebdetect.nbin...
NCR Aloha POS SMB Default Credentials
The remote NCR Aloha POS device is running with default credentials aloha / aloha. A remote, unauthenticated attacker could exploit this to take control of the system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108716; scriptversion"1.2"; scriptcvsdate"Date:...
CVE-2014-7333
The Aloha Guide aka com.aloha.guide.japnese application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-7317
The Aloha Bail Bonds aka com.onesolutionapps.alohabailbondsandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Design/Logic Flaw
The Aloha Bail Bonds aka com.onesolutionapps.alohabailbondsandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-7317
The CVE-2014-7317 entry concerns the Android app Aloha Bail Bonds (com.onesolutionapps.alohabailbondsandroid) version 1.1, which does not verify X.509 certificates from SSL servers. The underlying issue is a failure in TLS certificate validation that enables man-in-the-middle attackers to spoof s...
CVE-2014-7333
The CVE-2014-7333 entry concerns the Android application Aloha Guide (package com.aloha.guide.japnese) version 1.3, where the app does not verify X.509 certificates from SSL servers. Root cause: missing certificate verification in SSL/TLS, enabling man-in-the-middle attackers to spoof servers and...
CVE-2014-7333
The Aloha Guide aka com.aloha.guide.japnese application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-7317
The Aloha Bail Bonds aka com.onesolutionapps.alohabailbondsandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-6812
The Aloha Guide aka com.aloha.guide.english application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-6812
The Aloha Guide aka com.aloha.guide.english application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...