Amcrest Dahua NVR Camera IP2M-841 - Denial of Service Exploit

Exploit Title: Amcrest Dahua NVR Camera IP2M-841 - Denial of Service PoC Exploit Author: Jacob Baines Vendor Homepage: https://amcrest.com/ Software Link: https://amcrest.com/firmwaredownloads Version: Many different versions due to number of Dahua/Amcrest/etc devices affected Tested on: Amcrest...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2020-1203)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.2.0 : bind (EulerOS-SA-2020-1203)

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - It was found that bind does not implement reasonable restrictions for zone sizes. This allows an explicitly configured...

ZTE E8820V3 Privilege and Access Control Vulnerability

The ZTE E8820V3 is a Gigabit Dual Band 1200M with WiFi Smart Router. A privilege and access control vulnerability exists in ZTE E8820V3 V3.1.0.1000.4 and earlier versions. An attacker can exploit this vulnerability to tamper with DDNS parameters and conduct denial of service attacks via a specifi...

CVE-2020-6863

ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters and send DoS attacks on the specified URL...

Design/Logic Flaw

ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters and send DoS attacks on the specified URL...

CVE-2020-6863

CVE-2020-6863 affects the ZTE E8820V3 router with a permission and access control vulnerability that allows tampering with DDNS parameters and can lead to a DoS on a specified URL. The entry notes adjacent-network access with low complexity and a high impact on availability (per CVSS 3.1). The pr...

CVE-2020-6863

ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters and send DoS attacks on the specified URL...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2019-2453)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2019-2557)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-14929

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management ...

CVE-2019-14929

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management ...

Default credentials

An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. ...

CVE-2019-14929

CVE-2019-14929 affects Mitsubishi Electric Europe B.V. smartRTU ME-RTU devices (firmware up to 2.02) and INEA ME-RTU devices (up to 3.0). The root cause is unprotected storage of credentials (passwords stored in plaintext) due to weak credential management, enabling an unauthenticated attacker to...

CVE-2019-14929

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management ...

CVE-2019-6964

A heap-based buffer over-read in ServiceSetParamStringValue in cosaxciscocomddnsdml.c of the RDK RDKB-20181217-1 CcspPandM module may allow attackers with login credentials to achieve information disclosure and code execution by crafting an AJAX call responsible for DDNS configuration with an...

CVE-2019-6964

A heap-based buffer over-read in ServiceSetParamStringValue in cosaxciscocomddnsdml.c of the RDK RDKB-20181217-1 CcspPandM module may allow attackers with login credentials to achieve information disclosure and code execution by crafting an AJAX call responsible for DDNS configuration with an...

allianceauth (>=2.1.0 <=2.1.1), beanstalk-dispatch (>=0.0.3 <=0.0.5) +214 more potentially affected by CVE-2019-11358 via django (>=2.0.0 <=2.1.8)

django PYPI version =2.0.0, =2.1.0, =0.0.3, =0.1.0, =0.1.0, =0.5.0, =3.0.0, =2.1.0, =0.0.1, =1.1.0, =1.2.1 and more Source cves: CVE-2019-11358 Source advisory: OSV:GHSA-6C3J-C64M-QHGQ...

boorunaut (>=0.1.0 <=0.4.2), cloudxns-ddns-service (=1.0.0) +116 more potentially affected by CVE-2019-6975 via django (>=2.1.0 <=2.1.5)

django PYPI version =2.1.0, =0.1.0, =0.10.0, =2.4.0, =0.3.1, =0.1.6, =0.2.0, =1.3.2, =1.3.3 - django-autoconfig =0.8.0 and more Source cves: CVE-2019-6975 Source advisory: OSV:PYSEC-2019-18...

Design/Logic Flaw

To provide fine-grained controls over the ability to use Dynamic DNS DDNS to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update...