2376 matches found
CVE-2018-17500
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...
CVE-2018-17500: Insufficiently Protected Credentials
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...
CVE-2018-17499: Cleartext Storage of Sensitive Information
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...
Visitor Kiosk Access Systems Riddled with Bugs
Visitor-management systems protect business against physical threats such as unwanted and unidentified guests. But many of these lobby-based perimeter checkpoints are opening up companies to a bevy of cyber-threats. On Monday, IBM’s penetration testing team, X-Force Red, released a report that...
envoy/config_fuzz_test: Heap-use-after-free in std::__1::__bucket_list_deallocator<std::__1::allocator<std::__1::__hash_node_ba
Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5666128418832384 Project: envoy Fuzzer: libFuzzerenvoyconfigfuzztest Fuzz target binary: configfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...
envoy/config_fuzz_test: Heap-use-after-free in Envoy::Server::InitManagerImpl::initializeTarget
Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5664687524413440 Project: envoy Fuzzer: libFuzzerenvoyconfigfuzztest Fuzz target binary: configfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...
envoy/codec_impl_fuzz_test: Heap-use-after-free in Envoy::Http::HttpStream::HttpStream
Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5722972495544320 Project: envoy Fuzzer: libFuzzerenvoycodecimplfuzztest Fuzz target binary: codecimplfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8...
envoy/codec_impl_fuzz_test: NULL
Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5656339617939456 Project: envoy Fuzzer: libFuzzerenvoycodecimplfuzztest Fuzz target binary: codecimplfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address...
envoy/codec_impl_fuzz_test: Heap-use-after-free in Envoy::Http::HttpStream::directionalAction
Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5657409819770880 Project: envoy Fuzzer: libFuzzerenvoycodecimplfuzztest Fuzz target binary: codecimplfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8...
Weak Password Vulnerability in Enphase Envoy
The Enphase Envoy is the home energy control gateway at the heart of the Enphase Energy home energy solution. A weak password vulnerability exists in Enphase Envoy. A remote attacker is allowed to exploit the vulnerability to submit a special request for unauthorized access to the application...
Enphase Envoy Cross-Site Scripting Vulnerability
Enphase Envoy is a smart home referrer. enphase Envoy R3.. /home URI is vulnerable to cross-site scripting, which can be exploited by attackers to inject malicious scripts or HTML code...
Cross site scripting
XSS exists in Enphase Envoy R3.. via the profileName parameter to the /home URI on TCP port 8888...
Directory traversal
A directory traversal vulnerability was discovered in Enphase Envoy R3.. via images/, include/, include/js, or include/css on TCP port 8888...
CVE-2019-7677
XSS exists in Enphase Envoy R3.. via the profileName parameter to the /home URI on TCP port 8888...
CVE-2019-7676
A weak password vulnerability was discovered in Enphase Envoy R3... One can login via TCP port 8888 with the admin password for the admin account...
CVE-2019-7676
A weak password vulnerability was discovered in Enphase Envoy R3... One can login via TCP port 8888 with the admin password for the admin account...
Design/Logic Flaw
A weak password vulnerability was discovered in Enphase Envoy R3... One can login via TCP port 8888 with the admin password for the admin account...
CVE-2019-7677
XSS exists in Enphase Envoy R3.. via the profileName parameter to the /home URI on TCP port 8888...