753 matches found
Xxe
The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker...
CVE-2018-11316
The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker...
CVE-2018-11314
The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker...
CVE-2018-11316
The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker...
CVE-2018-11316
The CVE-2018-11316 entry concerns Sonos wireless speaker devices whose UPnP HTTP server can be abused via a DNS rebinding attack. The affected component is the Sonos UPnP web server; the underlying issue is lack of access restriction allowing unauthorized control and information exfiltration from...
PT-2018-10476
Name of the Vulnerable Software and Affected Versions Sonos wireless speaker products affected versions not specified Description The issue allows unauthorized access to the device via a DNS rebinding attack on the UPnP HTTP server. This can lead to remote device control and the exfiltration of...
CVE-2018-11314
The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker...
CVE-2018-11316: Improper Input Validation
The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker...
CVE-2018-11314: Improper Input Validation
The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker...
CVE-2018-11314
CVE-2018-11314 affects Roku and Roku TV External Control API. The vulnerability enables unauthorized remote control via DNS rebinding, potentially exposing privileged device and network information. Documented impact includes remote device control and data exfiltration on affected Roku platforms;...
Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
A vulnerability in Cisco-provided scripts disk-check.sh and harcap.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to...
CVE-2018-11315
The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat theat request that accesses a device purchased in the Spring of 2018, and sets a...
web interface of the Code Execution
The vulnerability of the web interface of Microprogramming Software-based Cisco RV132W ADSL2+ and Cisco RV134W VDSL2 routers is due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with root privileges...
Multiple vulnerabilities in Loxone Smart Home
Vendor & product description: "Loxone Electronics was founded in 2009. Our focus is the development and production of control solutions for all homes. Our aim is to make home automation interesting, affordable and accessible for everyone." URL: http://www.loxone.com/enus/company/about-us.html...
Contec Smart Home Unauthorized Password Reset Vulnerability
Contec Smart Home is a smart home management system for managing connected smart home devices. A security vulnerability exists in Contec Smart Home version 4.15, which stems from the program failing to require authentication for the newuser.php, edituser.php, deleteuser.php, and user.php files. A...
Contec Smart Home 4.15 - Unauthorized Password Reset
Contec Smart Home 4.15 - Unauthorized Password Reset Title : Contec smart home 4.15 Unauthorized Password Reset Shodan Dork : "content/smarthome.php" Vendor Homepage : http://contec.co.il Tested on : Google Chrome Tested version : 4.15 Date : 2018-03-14 Author : Z3ro0ne Contact :...
CVE-2018-0141
A vulnerability in Cisco Prime Collaboration Provisioning PCP Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by...
Huawei Mate 9 Pro Forensic Bypass Vulnerability
Huawei Mate 9 Pro is a smartphone from Huawei Huawei. A forensic bypass vulnerability in the voice wake-up module in the Huawei Mate 9 Pro phone could allow an attacker to trick a user into installing a malicious application, bypass authentication, and take control of the phone to send a short...
PT-2018-18008
Name of the Vulnerable Software and Affected Versions eQ-3 AG HomeMatic CCU2 version 2.29.22 Description The issue allows exploitation by sending arbitrary XML-RPC requests to control attached BidCos devices, due to an open XML-RPC port without authentication. Recommendations For version 2.29.22,...
K7 Antivirus Premium elevation of privilege vulnerability (CNVD-2018-02143)
K7 Antivirus Premium is a suite of anti-virus software from K7 Computing India. A security vulnerability exists in versions prior to K7 Antivirus Premium 15.1.0.53. A local attacker can exploit the vulnerability to gain privileges by sending a specific IOCTL...