Major Brands Sonos® and Bose® Multiple Vulnerabilities

漏洞详情请参考： https://paper.seebug.org/papers/Archive/D1%20COMMSEC%20-%20Stephen%20Hilt%20-%20Hacking%20IoT%20Speakers.pdf...

BOSE SoundTouch cross-site scripting vulnerability (CNVD-2018-08339)

The BOSE SoundTouch is a wireless speaker device from the American company BOSE. A cross-site scripting vulnerability exists in BOSE SoundTouch. A remote attacker could exploit this vulnerability to compromise an itunes/pandora account with specially crafted song data from a music service...

BOSE SoundTouch Remote Control Vulnerability

The BOSE SoundTouch is a wireless speaker device from the American company BOSE. A security vulnerability exists in BOSE SoundTouch. A remote attacker could exploit this vulnerability with the help of a specially crafted website to achieve remote control...

BOSE SoundTouch cross-site scripting vulnerability (CNVD-2018-08340)

The BOSE SoundTouch is a wireless speaker device from the American company BOSE. A cross-site scripting vulnerability exists in BOSE SoundTouch. A remote attacker can exploit the vulnerability to take control of an account with the help of a specially crafted Spotify public playlist...

CVE-2017-17749

Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora...

Design/Logic Flaw

Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora...

Design/Logic Flaw

Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify...

CVE-2017-17750

Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify...

CVE-2017-17751

Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol...

Design/Logic Flaw

Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol...

CVE-2017-17749

Bose SoundTouch devices are affected by a cross-site scripting (XSS) vulnerability triggered by specially crafted song data from a music service (e.g., Pandora). The issue arises in the handling of metadata or payload within song data, enabling an attacker-controlled input to be interpreted as ex...

CVE-2017-17750

Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify...

CVE-2017-17750

CVE-2017-17750 affects Bose SoundTouch devices. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via a crafted public playlist from Spotify, enabling script execution in user contexts. Root cause described across sources is XSS triggered by Spotify-public playlists; concrete pro...

CVE-2017-17751

Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol...

CVE-2017-17751

Bose SoundTouch devices are affected by CVE-2017-17751. A remote attacker can gain remote control by luring the device to a crafted website using the WebSocket protocol. The vulnerability is documented across multiple sources (e.g., NVD/NVD CVSS 2.0/3.0: base scores 6.8 (MEDIUM) and 8.8 (HIGH) re...

CVE-2017-17749

Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora...

PT-2018-6562 · Bose · Bose Soundtouch

Name of the Vulnerable Software and Affected Versions: Bose SoundTouch affected versions not specified Description: The issue allows for cross-site scripting XSS attacks through specially crafted song data from a music service. An example of such an attack is demonstrated using Pandora...

PT-2018-6564 · Bose · Bose Soundtouch

Name of the Vulnerable Software and Affected Versions: Bose SoundTouch affected versions not specified Description: The issue allows remote attackers to achieve remote control of Bose SoundTouch devices via a crafted web site that uses the WebSocket Protocol. Recommendations: At the moment, there...

PT-2018-6563 · Spotify +1 · Spotify +1

Name of the Vulnerable Software and Affected Versions: Bose SoundTouch affected versions not specified Description: The issue allows for cross-site scripting XSS attacks through a crafted public playlist from Spotify. Recommendations: At the moment, there is no information about a newer version...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...