CVE-2017-10793

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...

CVE-2017-14117

The CVE-2017-14117 vulnerability affects AT&T U-verse firmware 9.2.2h0d83 on Arris NVG589/NVG599 when IP Passthrough is not used. It configures an unauthenticated proxy service on WAN TCP port 49152, allowing remote attackers to establish arbitrary TCP connections to intranet hosts by sending the...

CVE-2017-10793: Exposure of Sensitive Information to an Unauthorized Actor

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...

PT-2017-11508

Name of the Vulnerable Software and Affected Versions AT&T U-verse firmware version 9.2.2h0d83 for Arris NVG589 and NVG599 devices Description The issue concerns the configuration of an sbdc.ha WAN TCP service on port 61001 with a specific account and password, allowing remote attackers to obtain...

CVE-2017-14115: Use of Hard-coded Credentials

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and...

CVE-2017-14116: Use of Hard-coded Credentials

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 an...

AT&T U-verse Arris Modems NVG589 / NVG599 / 5268AC Multiple Vulnerabilities (SharknATTo)

The remote Arris device's self report model is NVG589, NVG599 or 5268AC. It is, therefor, affected by multiple vulnerabilities, including a firewall bypass, multiple instances of hardcoded credentials, privilege escalation, and remote code execution. Note: Nessus has not checked the firmware...

at-rs.de XSS vulnerability

Vulnerable URL: https://www.at-rs.de/shop/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 633070 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|---...

Bugs in Arris Modems Distributed by AT&T Vulnerable to Trivial Attacks

Trivially exploitable vulnerabilities have been discovered in several Arris home modems, routers and gateways distributed to consumers and small businesses through AT&T’s U-verse service. It’s unknown yet whether the firmware vulnerabilities were introduced by the OEM or the ISP since AT&T seems ...

Open WAN-to-LAN proxy on AT&T routers

The Arris NVG589 and NVG599 routers configured with AT&T U-verse firmware 9.2.2h0d83 expose an un-authenticated proxy that allows connecting from WAN to LAN by MAC address. Module Options msf use auxiliary/scanner/wproxy/att/openproxy msf undefinedopenproxy show actions ...actions... msf...

Game Crunch Doesn't Always Have to be a Thing

You've been dreading the conversation. You know there's no way out of it, given the timeline. Your execs have made it clear that the very large marketing spend is going to hit during the week when two of your engineers were planning to be on vacation. You've got a brilliant team that has helped y...

CVE-2017-9647

A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 PMB 8876 chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015...

CVE-2017-9647

CVE-2017-9647 is a stack-based buffer overflow in Continental AG’s Infineon S-Gold 2 (PMB 8876) cellular baseband used in 2G TCUs. The flaw occurs in processing AT commands and could allow arbitrary code execution on the TCU baseband processor when an attacker has a physical connection to the TCU...

PT-2017-19094

Name of the Vulnerable Software and Affected Versions Infineon S-Gold 2 PMB 8876 chipset versions used in various vehicle models produced between 2009-2016 Description A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 PMB 8876 chipset. This issue allows an...

CVE-2017-9647: Stack-based Buffer Overflow

A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 PMB 8876 chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015...

DEBIAN-CVE-2017-12583

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

UBUNTU-CVE-2017-12583

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

CVE-2017-12583

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

CVE-2017-12583: Improper Neutralization of Input During Web Page Generation

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

PT-2017-12587

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2017-02-19b Description The issue concerns an XSS vulnerability in the at parameter, also known as the DATE AT variable, which is used in the "doku.php" endpoint. Recommendations For versions prior to 2017-02-19b,...