kernel: denial of service via ioctl call in network tun handling

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...

PT-2020-19240

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 74 Firefox ESR versions prior to 68.6 Thunderbird versions prior to 68.6 Description A issue exists where websites with camera or microphone permission can enumerate device names, potentially disclosing the user's nam...

Moxa AWK-3131A Operating System Command Injection Vulnerability (CNVD-2020-13481)

Moxa AWK-3131A is a wireless access device from Moxa. An operating system command injection vulnerability exists in the 'Device Name' in the Moxa AWK-3131A using firmware version 1.13. An attacker can exploit this vulnerability to execute arbitrary system commands to take control of the device...

CVE-2020-8824

Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless Access Control Add Managed Device screen...

Design/Logic Flaw

Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless Access Control Add Managed Device screen...

CVE-2020-8824

Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless Access Control Add Managed Device screen...

PT-2020-20307

Name of the Vulnerable Software and Affected Versions Hitron CODA-4582U version 7.1.1.30 Description The issue allows for XSS via a Managed Device name on the Wireless Access Control Add Managed Device screen. This can be exploited by manipulating the device name to inject malicious scripts...

CVE-2020-8824: Improper Neutralization of Input During Web Page Generation

Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless Access Control Add Managed Device screen...

PT-2020-9881 · Fasttrack · Fasttrack Admin By Request

Name of the Vulnerable Software and Affected Versions: FastTrack Admin By Request version 6.1.0.0 Description: The issue concerns the elevation of privileges to Administrator level. Normally, group policies restrict this ability to a select range of users. However, when a user without direct acce...

CVE-2020-6848

Axper Vision II 4 devices allow XSS via the DEVICENAME aka Device Name parameter to the configWebParams.cgi URI...

CVE-2020-6848

Axper Vision II 4 devices allow XSS via the DEVICENAME aka Device Name parameter to the configWebParams.cgi URI...

PT-2020-19262

Name of the Vulnerable Software and Affected Versions Axper Vision II version 4 Description The issue allows for XSS via the DEVICE NAME parameter to the "configWebParams.cgi" URI. Recommendations For Axper Vision II version 4, avoid using the DEVICE NAME parameter in the "configWebParams.cgi" UR...

CVE-2018-10700

An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iwboarddeviceName" is susceptible to this...

CVE-2018-10700

CVE-2018-10700 affects Moxa AWK-3121 (version 1.19). The vulnerability arises in the web interface via the POST parameter iw_board_deviceName, allowing an attacker to inject a payload and execute cross-site scripting (XSS). The issue is tied to an input handling flaw in the device name change fun...

PT-2019-8767

Name of the Vulnerable Software and Affected Versions Moxa AWK-3121 version 1.19 Description An issue was discovered that allows an attacker to execute XSS by injecting an XSS payload through the iw board deviceName parameter in the device name change functionality. This affects the ability of an...

UBUNTU-CVE-2018-7191

In the tun subsystem in the Linux kernel before 4.13.14, devgetvalidname is not called before registernetdevice. This allows local users to cause a denial of service NULL pointer dereference and panic via an ioctlTUNSETIFF call with a dev name containing a / character. This is similar to...

CVE-2018-12638

An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app...

PT-2019-8913

Name of the Vulnerable Software and Affected Versions Bose Soundtouch app version 18.1.4 Description An issue in the Bose Soundtouch app allows for the execution of JavaScript on a registered Bose User Account if a speaker has been connected to the app. This is possible due to the lack of fronten...

CVE-2018-12638: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app...

Buffer Overflow Vulnerability in iSmartViewPro Software

iSmartViewPro is a network surveillance software to monitor your home or store in real time. Users can add, edit or delete devices, watch videos in real time, control the PTZ by sliding or pressing buttons, set video parameters, capture pictures, playback videos, set alarms, etc. It can be used t...