4885 matches found
Exploit for OS Command Injection in Webmin
CVE-2019–15107 - Unauthenticated RCE Webmin =1.920 This...
Code Execution Vulnerability in 37GameBox of Shanghai Hardtone Network Technology Co.
37GameBox is a web game box tool under Sanqi Entertainment. Ltd. 37GameBox suffers from a code execution vulnerability that can be exploited by an attacker to execute an executable program containing arbitrary code during the immediate experience after installation...
picketbox: JBoss EAP reload to admin-only mode allows authentication bypass
A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user...
Authentication Bug Opens Android Smart-TV Box to Data Theft
A critical bug in the Hindotech HK1 TV Box would allow root-privilege escalation thanks to improper access control. A successful exploit would allow attackers to steal social-networking account tokens, Wi-Fi passwords, cookies, saved passwords, user-location data, message history, emails, contact...
black-box-music.de Improper Access Control vulnerability OBB-1395257
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Scanners-Box
This is a collection of open-source scanning tools, referred to as "Scanners Box" or "scanbox," maintained by the user "We5ter" on GitHub. The repository contains various tools for scanning and testing different aspects of a system or network, including subdomain enumeration, database vulnerabili...
PT-2020-5055
Name of the Vulnerable Software and Affected Versions HiSilicon Hi3520D affected versions not specified Description The issue is related to the lack of authentication for a critical function in the HiSilicon Hi3520D chip set's firmware. This can be exploited by a remote attacker to cause a denial...
CVE-2020-24217: Missing Authentication for Critical Function
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to...
CVE-2020-24215: Use of Hard-coded Credentials
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration with the cleartext admin password, and...
PT-2020-15661
Name of the Vulnerable Software and Affected Versions box application on HiSilicon based IPTV/H.264/H.265 video encoders affected versions not specified Description An issue was discovered in the box application, where attackers can use hard-coded credentials in HTTP requests to perform...
PT-2020-15660
Name of the Vulnerable Software and Affected Versions box application on HiSilicon based IPTV/H.264/H.265 video encoders affected versions not specified Description An issue in the box application allows attackers to send a crafted unauthenticated RTSP request, causing a buffer overflow and...
PT-2020-15662
Name of the Vulnerable Software and Affected Versions box application on HiSilicon based IPTV/H.264/H.265 video encoders affected versions not specified Description An issue in the box application allows unauthenticated attackers to view private video streams. When an administrator sets up a secr...
CVE-2020-24214: Undefined Security Weakness
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming fo...
CVE-2020-5979
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box for input by a high-privilege process, which may lead to escalation of privileges...
CVE-2020-5979: Undefined Security Weakness
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box for input by a high-privilege process, which may lead to escalation of privileges...
Remote Code Execution (RCE)
chakracore is vulnerable to remote code execution. The vulnerability exists due to a memory error when StackScriptFunction::BoxState::Box, in lib/Runtime/Library/StackScriptFunction.cpp, is called...
NaCl Is Not a High-Level API
When talking about high-level application cryptography APIs I usually hear mentioned libsodium, Tink, pyca/cryptography, and NaCl. One of these things is not like the others! The value NaCl had 10 years ago was that it was an opinionated library at a time when all cryptography libraries were...
CVE-2020-11618
THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start on boot, which allows an attacker on the local network to achieve root access via the TELNET protocol...
muzik-box.ru Cross Site Scripting vulnerability OBB-1275675
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
