1439 matches found
CVE-2020-27542: Improper Neutralization of Special Elements used in an OS Command
Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code including network settings. The static IP configuration from QR code is copied to the file /config/ip-static and after reboot data from this file is inserted into bash command without...
CVE-2020-27540: Improper Verification of Cryptographic Signature
Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. The camera reads firmware update configuration from SD card file vc\version.json. fw-sign parameter and from this configuration is directly inserted into a bash command. Firmware update is run...
PT-2021-11403
Name of the Vulnerable Software and Affected Versions: Rostelecom CS-C2SHW version 5.0.082.1 Description: The issue is related to a Denial of Service vulnerability. It occurs due to a bug in the AgentGreen service when parsing broadcast discovery UDP packets. If a packet of too small size is sent...
PT-2021-11402
Name of the Vulnerable Software and Affected Versions: Rostelecom CS-C2SHW version 5.0.082.1 Description: A Bash injection vulnerability and bypass of signature verification exist in the firmware update process. The camera reads firmware update configuration from an SD card file named...
PT-2021-11401
Name of the Vulnerable Software and Affected Versions: Rostelecom CS-C2SHW version 5.0.082.1 Description: The issue is related to a heap overflow that occurs with full parsing of HTTP responses. This is due to a self-written HTTP parser and builder in the AgentUpdater service, which has a heap...
CVE-2020-27539: Out-of-bounds Write
Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1. AgentUpdater service has a self-written HTTP parser and builder. HTTP parser has a heap buffer overflow OOB write. In default configuration camera parses responses only from HTTPS URLs from config file, so vulnerabl...
Skyworth Home Gateway Smart Terminal DT720-cs Has Denial of Service Vulnerability
hereinafter referred to as "Skyworth Digital" is a national high-tech enterprise focusing on providing comprehensive and systematic digital home solutions and services for global users. A denial of service vulnerability exists in the Skyworth Home Gateway Smart Terminal DT720-cs, which can be...
CS Money: Cookie poisoning leads to DOS and Privacy Violation
Summary, submitted by gatolouco requires no additions by us and fully expresses impact and reasons behind the vulnerability. Summary By change the value of the cookie avatar, a hacker could not only get information of the support agent IP address, but also disconnect all the supports without...
PT-2020-16764 · Robbie Van Bommel · Rvtools
Name of the Vulnerable Software and Affected Versions: RVTools version 4.0.6 Description: The issue concerns the encryption of passwords in RVTools. Specifically, the RVToolsPasswordEncryption.exe utility in RVTools 4.0.6 uses a static initialization vector IV and key for encryption. This static...
cs.daedong.co.kr Cross Site Scripting vulnerability OBB-1465750
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CS Money: Attacker can generate cancelled transctions in a user's transaction history using only Steam ID
Summary: The API endpoint /create-payment requires only the steam ID of the account to create the payment. When this endpoint is called using the cardpay flow, it returns a transaction ID on the Cardpay system. The attacker can access this transaction, and immediately cancel it or pay it ; , whic...
cs.teilar.gr Cross Site Scripting vulnerability OBB-1450541
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CS Money: Blind XSS on image upload
Summary: - The CSRF vulnerability make a request for support.cs.money/uploadfile; This uploadfile does not have csrf token/ origin/ reference verification! - The XSS allows to execute JS. The payload of the XSS stay in the param 'filename' of the CSRF request. Steps To Reproduce: XSS - use a prox...
CS-Cart 1.3.3 Remote Code Execution
Exploit Title: CS-Cart authenticated RCE Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.3 Vulnerability Type: authenticated RCE get PHP shells from http://pentestmonkey.net/tools/web-shells/php-reverse-shell edit ...
CS-Cart 1.3.3 Local File Inclusion
Exploit Title: CS-Cart unauthenticated LFI Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.4 Vulnerability Type: unauthenticated LFI...
CS-Cart 1.3.3 - 'classes_dir' LFI
Exploit Title: CS-Cart unauthenticated LFI Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.4 Vulnerability Type: unauthenticated LFI...
CS-Cart 1.3.3 - authenticated RCE
Exploit Title: CS-Cart authenticated RCE Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.3 Vulnerability Type: authenticated RCE get PHP shells from http://pentestmonkey.net/tools/web-shells/php-reverse-shell edit ...
cs-jy.cn Cross Site Scripting vulnerability OBB-1396080
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CS Money: Content Spoofing/Text Injection in https://support.cs.money and JS file not minified and uglyfied which makes it clearly readable
Issue 1: Greetings, Hello Team, I have found a Content Spoofing/Text Injection on this domain https://support.cs.money Using the below link the attacker can trick any genuine user to go to the attacker's phishing site. The attacker could craft the URL by providing discounts which will tempt the...
CS Money: Improper authentication in the load sell inventory page
Summary: Hello team, I found an endpoint response all data relate to sell mode inventory that doesn't have improper authentication in the link: https://cs.money/loadsellmodeinventory Steps To Reproduce: add details for how we can reproduce the issue 1. Open directly the link:...