BBC Inside Out. Consumer advice for the ‘smart’ homeowner

We were recently asked to demonstrate security flaws in a smart home for the BBC Inside Out TV show. We’ve done this before, so what was different? This home was by far the most connected we had looked at. Typically, homes have a few smart devices; a smart thermostat, CCTV, maybe a doorbell and...

CVE-2018-16198

Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network segment to access a non-documented developer screen to perform operations on the affected device...

CVE-2018-15414

creationtimestamp| type| source ---|---|--- 2018-09-21 22:27:28+00:00| seen| MISP/5ba56ff7-d494-42a5-a402-64760a021402...

CVE-2016-4998

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilterprivescipv4.rb 2025-02-06 03:13:42+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:09:48+00:00| seen|...

CVE-2018-7602

creationtimestamp| type| source ---|---|--- 2018-04-25 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44542 2018-04-26 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=287 2018-04-30 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44557...

CVE-2018-6193

creationtimestamp| type| source ---|---|--- 2018-02-28 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44216...

CVE-2018-0838

creationtimestamp| type| source ---|---|--- 2018-02-15 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44080...

Apache Tomcat Incorrectly Documented CGI Search Algorithm (Jan 2018) - Windows

Apache Tomcat has an incorrectly documented CGI search algorithm. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...

CVE-2017-13209

creationtimestamp| type| source ---|---|--- 2018-01-11 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43513...

CVE-2017-13216

creationtimestamp| type| source ---|---|--- 2018-01-08 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43464...

Deconf: Unauthenticated Reflected XSS in admin dashboard

The researcher has identified a Reflected XSS vulnerability within an analytics report of our plugin. The report was well documented, providing a step-by-step PoC to demonstrate the vulnerability...

CVE-2017-7056

creationtimestamp| type| source ---|---|--- 2017-07-25 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42376...

JVN#85901441: Multiple vulnerabilities in Toshiba Lighting & Technology Corporation Home gateway

Home gateway provided by Toshiba Lighting & Technology Corporation contains multiple vulnerabilities listed below. Non-documented developer's screen CWE-912 - CVE-2017-2234 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N| Base Score: 2.4 CVSS v2|...

CVE-2017-9756

creationtimestamp| type| source ---|---|--- 2017-06-19 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42204...

CVE-2016-9813

creationtimestamp| type| source ---|---|--- 2017-06-12 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42162...

CVE-2017-6361

creationtimestamp| type| source ---|---|--- 2017-04-07 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41842...

CVE-2017-6359

creationtimestamp| type| source ---|---|--- 2017-04-07 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41842...

CVE-2016-9180

perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting...

CVE-2016-4484

creationtimestamp| type| source ---|---|--- 2016-11-15 10:06:54+00:00| published-proof-of-concept| https://t.me/FullDisclosure/288 2016-11-15 10:07:25+00:00| published-proof-of-concept| https://t.me/FullDisclosure/289 2016-11-15 10:07:55+00:00| published-proof-of-concept|...

Axis Communications MPQTPACS 5.20.x - Server-Side Include Daemon Remote Format String

Axis Communications MPQTPACS 5.20.x - Server-Side Include Daemon Remote Format String !/usr/bin/env python2.7 SOF Remote Format String Exploit Axis Communications MPQT/PACS Server Side Include SSI Daemon Research and development by bashis 2016 This format string vulnerability has following...