CVE-2017-17291

CVE-2017-17291 is a memory-leak vulnerability in a wide range of Huawei enterprise devices (e.g., AR/AR1200/AR3200/SRG/NetEngine lines, TE/DP300/MAX PRESENCE, etc.). The issue arises when parsing crafted XML files: the software fails to free allocated memory, leading to a memory leak. An authenti...

CVE-2017-17294

CVE-2017-17294 describes a null pointer dereference in a broad set of Huawei enterprise router products (e.g., AR-series and SRG/NetEngine lines) caused by insufficient input validation when processing a crafted XML file. An authenticated, local attacker can trigger this by uploading a tailored X...

CVE-2017-17287

The CVE-2017-17287 issue affects a broad set of Huawei devices (AR/AR1200, AR150/AR160/AR200 families, NetEngine16EX, SRG/SRG-like series, etc.) and is tied to an out-of-bounds read triggered by insufficient input validation when processing crafted signatures. The vulnerability allows a remote, u...

CVE-2017-17295

CVE-2017-17295 describes buffer overflow vulnerabilities in numerous Huawei products caused by insufficient validation of SIP package values. An unauthenticated, remote attacker may send crafted SIP packages to affected devices (e.g., AR120-S, AR1200, AR150/AR200 families and others listed) to tr...

CVE-2017-15332

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20,...

CVE-2017-17202

Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R005C32, V200R006C10, V200R007C00,...

CVE-2017-17293

CVE-2017-17293 affects Huawei AR/SRG products (e.g., AR120-S, AR1200, AR150, AR200, AR2200, SRG1300/2300/3300, TE/DP300, MAX PRESENCE, NetEngine, RP200, etc.). A crafted XML file can be submitted to vulnerable devices, exploiting insufficient input validation to trigger a buffer overflow. An auth...

CVE-2017-17293

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20,...

CVE-2017-17286

Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R005C32, V200R006C10, V200R007C00,...

Multiple Huawei products cross-border read vulnerability (CNVD-2018-02555)

Huawei AR series routers, SRG series routing gateways, NetEngine16EX, and other products from Huawei China. The out-of-bounds read vulnerability exists in multiple Huawei products and is due to the device failing to adequately validate input. A remote attacker could exploit this vulnerability by...

artda.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-549958 Description| Value ---|--- Affected Website:| artda.co.kr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

RetDec - A Retargetable Machine-Code Decompiler

RetDec is a retargetable machine-code decompiler based on LLVM. The decompiler is not limited to any particular target architecture, operating system, or executable file format: Supported file formats: ELF, PE, Mach-O, COFF, AR archive, Intel HEX, and raw machine code. Supported architectures 32b...

myheritage.com XSS vulnerability

Open Bug Bounty ID: OBB-457329 Description| Value ---|--- Affected Website:| myheritage.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

ar-europe.ie XSS vulnerability

Open Bug Bounty ID: OBB-455829 Description| Value ---|--- Affected Website:| ar-europe.ie Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-8147

AC6005 V200R006C10SPC200,AC6605 V200R006C10SPC200,AR1200 with software V200R005C10CP0582T, V200R005C10HP0581T, V200R005C20SPC026T,AR200 with software V200R005C20SPC026T,AR3200 V200R005C20SPC026T,CloudEngine 12800 with software V100R003C00, V100R005C00, V100R005C10, V100R006C00,...

ar-go.co.il XSS vulnerability

Open Bug Bounty ID: OBB-360819 Description| Value ---|--- Affected Website:| ar-go.co.il Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

cdi.mecon.gob.ar XSS vulnerability

Vulnerable URL: http://cdi.mecon.gob.ar/greenstone/cgi-bin/library.cgi?site=localhost=p=about=confere1=es=%22%3E%3Csvg%2Fonload%3Dalert%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.01.2018 Vulnerability type:| XSS Vulnerability status:| Public...

Denial of Service Vulnerability in Multiple Huawei Products (CNVD-2017-34448)

The AR Series, SRG Series, and NetEngine16EX Services Routing Gateway are Huawei's all-in-one integrated services gateways for small and medium-sized branch offices and SMBs. Huawei SMC2.0 is a video service management platform. A denial-of-service vulnerability exists in multiple Huawei products...

expedia.com.ar XSS vulnerability

Vulnerable URL: https://www.expedia.com.ar/m/trips/2345" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 199193 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability...

BSides Manchester: Malvertising – under the hood

I've talked about malvertising a fair bit at security events down the years and I was lucky enough to be able to add to the tally at this month's BSides Manchester conference. Whether your preferred variety is desktop, mobile, or even virtual/augmented reality, there's hopefully something here fo...