1739 matches found
CVE-2017-9765
Integer overflow in the soapget function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service stack-based buffer overflow and application crash via a large XML document, aka Devil'...
gSOAP open-source software development library aeration“green rose”vulnerability, millions of IoT devices in jeopardy-vulnerability warning-the black bar safety net
Remember a few days ago Avanti vending machines loopholes, leakage of a large amount of user information? It didn't take long, the other one for IoT device attacks appeared again, this time the recruitment is the development of IoT devices open-source software library that may affect millions of...
Bad Code Library Triggers Devil's Ivy Vulnerability in Millions of IoT Devices
Tens of millions of products ranging from airport surveillance cameras, sensors, networking equipment and IoT devices are vulnerable to a flaw that allows attackers to remotely gain control over devices or crash them. The vulnerability, dubbed Devil’s Ivy, was identified by researchers at Senrio...
AXIS gSOAP Message Handling RCE (ACV-116267) (Devil's Ivy)
The remote AXIS device is running a firmware version that is missing a security patch. It is, therefore, affected by a remote code execution vulnerability, known as Devil's Ivy, due to an overflow condition that exists in a third party SOAP library gSOAP. An unauthenticated, remote attacker can...
Devil's Ivy vulnerability(CVE-2017-9765)
When we began a security analysis of remote configuration services last year, we had no idea it would lead us to uncover vulnerabilities that affect so many users. We have been studying the prevalence and nature of the vulnerabilities that arise in remote configuration services, so when we...
Axis Camera Multiple Products RCE (Devil's Ivy)
Binary data 7279.pasl...
Experts in Lather Over ‘gSOAP’ Security Flaw
Axis Communications -- a maker of high-end security cameras whose devices can be found in many high-security areas -- recently patched a dangerous coding flaw in virtually all of its products that an attacker could use to remotely seize control over or crash the devices. The problem wasn't specif...
Remotely Exploitable Flaw Puts Millions of Internet-Connected Devices at Risk
Security researchers have discovered a critical remotely exploitable vulnerability in an open-source software development library used by major manufacturers of the Internet-of-Thing devices that eventually left millions of devices vulnerable to hacking. The vulnerability CVE-2017-9765, discovere...
Oracle Human Resources Management System PeopleSoft unauthorized remote code execution vulnerability parsing-vulnerability warning-the black bar safety net
! A few months ago, I had the privilege of participating in several of Oracle's PeopleSoft construction project Safety Audit, the audit object mainly for the PeopleSoft series of Human Resources Management System, HRMS, and development tools package PeopleTool it. Throughout the online on the...
Oracle PeopleSoft Remote Code Execution: Blind XXE to SYSTEM Shell
Oracle PeopleSoft I had the chance, a few months ago, to audit several Oracle PeopleSoft solutions, including PeopleSoft HRMS and PeopleTool. Despite several undocumented CVEs, the Internet did not have much to offer on how to attack the software, except for the very informative talk from ERPScan...
CVE-2015-8257
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to 1 applicense.shtml, 2 applicensecustom.shtml, 3 appindex.shtml, or 4 appparams.shtml...
Code injection
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to 1 applicense.shtml, 2 applicensecustom.shtml, 3 appindex.shtml, or 4 appparams.shtml...
CVE-2015-8257
CVE-2015-8257 affects Axis Communications AXIS Network Cameras with the devtools.sh vector. Remote authenticated users can execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml....
CVE-2015-8257
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to 1 applicense.shtml, 2 applicensecustom.shtml, 3 appindex.shtml, or 4 appparams.shtml...
Axis Devices Detection (FTP)
FTP based detection of Axis devices. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...
CVE-2015-8256
Multiple cross-site scripting XSS vulnerabilities in Axis network cameras...
CVE-2015-8256
Axis Network Cameras are affected by CVE-2015-8256, a set of stored and reflected cross-site scripting (XSS) vulnerabilities due to improper input validation in the web interfaces. The initiative originates in Axis Network Cameras, with attacker-controlled payloads potentially executed in a victi...
CVE-2015-8256
Multiple cross-site scripting XSS vulnerabilities in Axis network cameras...