Code injection

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials...

IoT: OFF by default

It’s increasingly difficult to buy home appliances and other tech that DOESN’T have connectivity. Despite reservations about the security of smart tech, if we want to buy mid to high end devices, we often have no choice but to buy appliances with connectivity. To quote @Mikko Hypponen: If it is...

The vulnerability of the Cisco Digital Network Architecture (DNA) Center’s network management system is related to the insecure default configuration settings. This allows attackers to bypass authentication procedures, gain access to system files, and modify them.

The vulnerability of the Cisco Digital Network Architecture DNA Center network management system arises from insecure default configuration settings. Exploiting this vulnerability could allow a malicious actor to bypass authentication procedures, gain access to system files, and modify them...

Pydio 8.2.1 Unauthenticated Remote Code Execution

Impact The vulnerability, a PHP object injection, was fixed in the latest security release of Pydio. Affected are all installations below version 8.2.2 with default settings. The vulnerability allowed remote attackers to perform a full takeover of the filesharing system, leading to remote access ...

Removing the jam in your printer security

Printers are an important, invisible—albeit sometimes loud—component of the office. But all too often they’re filled with mystery meat icons, peculiar blinking lights, or error messages with no instruction manual to hand. No problem, you can just print at the next station! Wrong. Printers also...

CVE-2018-1420

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix CF installation. This can lead to security miss-configuration of the installation. IBM X-Force ID: 138950...

Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router) Exploit

Exploit for hardware platform in category web applications Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery Reboot Router Exploit Author: Nathu Nandwani Website: http://nandtech.co CVE: CVE-2015-5996 Description: The router is vulnerable to a cross-site request forge...

Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)

Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery Reboot Router Date: 2018-07-21 Exploit Author: Nathu Nandwani Website: http://nandtech.co CVE: CVE-2015-5996 Description: The router is vulnerable to a cross-site request forgery attacker. If an administrator is...

Tenda Wireless N150 Router 5.07.50 Cross Site Request Forgery

Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery Reboot Router Date: 2018-07-21 Exploit Author: Nathu Nandwani Website: http://nandtech.co CVE: CVE-2015-5996 Description: The router is vulnerable to a cross-site request forgery attacker. If an administrator is...

Security Bulletin: IBM Forms Experience Builder vulnerable to CSRF when configured with non default settings (CVE-2016-2884)

Summary A cross-site request forgery attack is possible when configured with non default settings, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2016-2884 DESCRIPTION: IBM Forms Experience Builder is vulnerable to cross-site request forgery, when configure...

hapi node module security restriction vulnerability

The hapi node module is a server framework for Node.js. The framework supports input validation, caching, authentication and more. A security vulnerability exists in hapi node module versions prior to 11.1.4. An attacker can exploit the vulnerability to override a higher security restriction...

CVE-2018-12048

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings...

CVE-2018-12049

A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default setting...

Design/Logic Flaw

DISPUTED A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the defaul...

CVE-2018-12048

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings...

CVE-2018-12049

A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default setting...

Canon MF210/MF220 Series Printers Access Bypass Vulnerability (Apr 2018)

Canon MF210/MF220 Series Printers are prone to an access bypass vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

Design/Logic Flaw

DISPUTED A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer kee...

CVE-2018-11711

A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the...

CVE-2018-11711

A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the...