67 matches found
CVE-2021-32934
Summary of CVE-2021-32934 : Affects ThroughTek P2P SDKs (versions ≤ 3.1.5, any nossl-tag builds) and certain firmware configurations (no AuthKey for IOTC, AVAPI without DTLS, P2PTunnel/RDT) where data between the local device and ThroughTek servers is not properly protected. This results in clear...
Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices
Today, Mandiant disclosed a critical risk vulnerability in coordination with the Cybersecurity and Infrastructure Security Agency “CISA” that affects millions of IoT devices that use the ThroughTek “Kalay” network. This vulnerability, discovered by researchers on Mandiant’s Red Team in late 2020,...
ThroughTek Kalay P2P SDK
1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThroughTek Equipment: Kalay P2P SDK Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could permit remote code execution and unauthorized access to...
PT-2021-19981
Name of the Vulnerable Software and Affected Versions ThroughTek P2P products versions prior to 3.1.5 ThroughTek P2P products with nossl tag ThroughTek P2P products with device firmware not using AuthKey for IOTC connection ThroughTek P2P products with firmware using AVAPI module without enabling...
ThroughTek P2P SDK
1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThroughTek Equipment: P2P SDK Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION ThroughTek supplies multiple original equipment manufacturers of IP cameras with P2P...
Information Disclosure
ansible is vulnerable to information disclosure. The nolog feature is not enabled by default and confidential information such as the authkey and privkey are logged to the console...
MISP cross-site scripting vulnerability (CNVD-2021-08162)
MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in...
CVE-2020-29572
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...
CVE-2020-29572
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...
Design/Logic Flaw
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...
CVE-2020-29572: Improper Neutralization of Input During Web Page Generation
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...
CVE-2020-29572
CVE-2020-29572 affects MISP 2.4.135, with a cross-site scripting vulnerability in the file app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp via the authkey comment field. The root cause is unsanitized input leading to XSS in the template rendering, enabling arbitrary script e...
CVE-2020-29572
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...
MISP Cross-Site Script Vulnerabilities
MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in...
PT-2020-17195
Name of the Vulnerable Software and Affected Versions MISP version 2.4.135 Description The issue is related to a XSS vulnerability via the authkey comment field in the genericField.ctp file. This allows for potential exploitation. Recommendations For MISP version 2.4.135, update to a version that...
PT-2019-12877
Name of the Vulnerable Software and Affected Versions Espressif ESP8266 NONOS SDK versions 2.2.0 through 3.1.0 Description The issue is related to the client 802.11 mac implementation, which does not correctly validate the RSN AuthKey suite list count in certain frames. This allows attackers with...
Discuz X3. 3 authkey generation algorithm of the security vulnerability and the background arbitrary code execution vulnerability
0x00 background description Discuz official in 2017 8 May 1 release of the latest version of the X3. 4 version, the latest version fixes multiple security issues. 360CERT and 360 0KEE Team then for the events to follow. 0x01 vulnerability overview 360CERT and 360 0KEE Team by comparing DiscuzX3...
Discuz X3. 3 patch security analysis-vulnerability warning-the black bar safety net
Discuz official in 2017 8 May 1 release of the latest version of the X3. 4 version, the latest version fixes multiple security issues. 360CERT and 360 0KEE Team then for the events to follow. 0x01 vulnerability overview 360CERT and 360 0KEE Team by comparing DiscuzX3. 3SCUTF8 with DiscuzX3. 4SCUT...