CVE-2017-8839

CVE-2017-8839 is an XSS vulnerability in Peplink Balance devices (models 305, 380, 580, 710, 1350, 2500) due to injection through the orig_url parameter in guest/preview.cgi. Affected firmware is fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093 (pre-patch); vulnerable firmware include...

CVE-2017-8835

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a sessi...

CVE-2017-8835

CVE-2017-8835 describes an unauthenticated SQL injection in Peplink Balance routers (models 305, 380, 580, 710, 1350, 2500) that is triggered via the bauth cookie to the path cgi-bin/MANGA/admin.cgi. The underlying issue enables an attacker to observe session data and enumerate user accounts, as ...

CVE-2017-8836

CVE-2017-8836 is a CSRF flaw in Peplink Balance routers (models 305, 380, 580, 710, 1350, 2500) on firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The vulnerability arises because the administrative CGI scripts are not CSRF-protected, enabling an attacker to execute ...

CVE-2017-8838

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi...

CVE-2017-8839

XSS via origurl exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The affected script is guest/preview.cgi...

CVE-2017-8836

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious...

CVE-2017-8840

Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 shows Master LAN Address, Serial Number, HA Group ID, Virtual IP, a...

Peplink 7.0.0-build1904 XSS / CSRF / SQL Injection / File Deletion

X41 D-Sec GmbH Security Advisory: X41-2017-005 Multiple Vulnerabilities in peplink balance routers =================================================== Overview -------- Confirmed Affected Versions: 7.0.0-build1904 Confirmed Patched Versions:...

Game Multi Android app has design flaws in password recovery feature

Game Multi app is a software that focuses on serving game users. Game Multi Android app has a vulnerability in the design of the password recovery function, which can be exploited by an attacker to change his password through another person's cell phone number, log in to the system and obtain...

CVE-2017-7250

A Cross-Site Scripting XSS was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data action passed to the 'Gazelle-master/sections/tools/finances/bitcoinbalance.php' URL. An attacker could execute arbitrary HTML and script code in a...

CVE-2017-7250

A Cross-Site Scripting XSS was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data action passed to the 'Gazelle-master/sections/tools/finances/bitcoinbalance.php' URL. An attacker could execute arbitrary HTML and script code in a...

True Free Balance - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application True Free Balance published at the 'play' market has multiple vulnerabilities...

kernel: Use after free in array_map_alloc

Use after free vulnerability was found in percpu using previously allocated memory in bpf. First allocpercpugfp is called, then the memory is freed with freepercpu which triggers async pcpubalancework and then pcpuextendareamap could use a chunk after it has been freed...

kernel: Use after free in array_map_alloc

Use after free vulnerability was found in percpu using previously allocated memory in bpf. First allocpercpugfp is called, then the memory is freed with freepercpu which triggers async pcpubalancework and then pcpuextendareamap could use a chunk after it has been freed...

Logic design flaw vulnerability at DBSHOP_0.9.3_Beta /module/Shopfront/src/Shopfront/Controller/CartController.php

DBShop is an open source e-commerce online store system developed using endFramework. DBSHOP0.9.3Beta /module/Shopfront/src/Shopfront/Controller/CartController.php at the logical design flaws vulnerability. When adding an order, it fails to determine the quantity of the product and directly...

Logic design flaw vulnerability at DBSHOP_0.9.3_Beta /module/Shopfront/src/Shopfront/Controller/HomemoneyController.php

DBShop is an open source e-commerce online store system developed using endFramework. DBSHOP0.9.3Beta /module/Shopfront/src/Shopfront/Controller/HomemoneyController.php at the logical design flaws vulnerabilities. The vulnerability is caused due to the fact that when withdrawing money, the system...

FantasyTote: Urgent Fix Balance Limit bypass

Hi check this Video POC i am able to bypass the Limit of deposite balnce the limit is 150 but i can put 2000 https://drive.google.com/file/d/0B-HtZBO84sdSMkFEQ21vZW5Uak0/view Thanks Regards Tayyab Qadir...

Balance Ball - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Balance Ball published at the 'play' market has multiple vulnerabilities...

Balance Ball - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Balance Ball published at the 'play' market has multiple vulnerabilities...