CVE-2018-3912

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. The strcpy call overflows the destination buffer, which has a size of 128...

CVE-2018-3912

CVE-2018-3912 affects Samsung SmartThings Hub STH-ETH-250 firmware 0.20.17. The video-core HTTP server copies database fields from shard into a stack-allocated structure using strcpy without length checks, enabling stack-based buffer overflows (secretKey, plus other fields with varying sizes). An...

CVE-2018-3878

Samsung SmartThings Hub STH-ETH-250 with firmware 0.20.17 contains multiple buffer overflow vulnerabilities in the video-core HTTP server credentials handler. Specifically, CVE-2018-3873 through CVE-2018-3878 arise from user-controlled JSON, where a strncpy copies a string without length checks, ...

CVE-2018-3867

CVE-2018-3867 describes a stack-based buffer overflow in Samsung SmartThings Hub (STH-ETH-250) video-core HTTP server. The vulnerability exists in the samsungWifiScan callback handling during camera discovery, where the hub constructs a POST to a callback URL using an unconstrained camera respons...

CVE-2018-3905

CVE-2018-3905 applies to Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17). The video-core HTTP server’s camera-create path mishandles the JSON field state, copying it into a stack buffer without size checks, causing a stack-based buffer overflow that can enable code execution when a crafted...

CVE-2018-3879

CVE-2018-3879 describes a JSON injection in Samsung SmartThings Hub video-core’s credentials handler that leads to a SQL injection in the SQLite database. Affected device: Samsung SmartThings Hub STH-ETH-250 with firmware 0.20.17. Root cause: the video-core HTTP server parses user-controlled JSON...

CVE-2018-3863

Summary: CVE-2018-3863 covers buffer-overflow vulnerabilities in Samsung SmartThings Hub video-core (STH-ETH-250) firmware 0.20.17. The /samsungWifiScan HTTP POST parses a user-controlled JSON payload and copies JSON-string values to 40-byte buffers using strcpy, without bounding, enabling stack ...

CVE-2018-3917

CVE-2018-3917 (and related TALOS/CNA entries) affects Samsung SmartThings Hub STH-ETH-250 firmware 0.20.17. The video-core HTTP server reads shard table fields (region among others) from SQLite and copies them with strcpy into fixed-size buffers, causing a stack-based buffer overflow when arbitra...

CVE-2018-3903

Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17) is affected by video-core HTTP server buffer overflows (CVE-2018-3903/3904). The vulnerability stems from copying user-controlled JSON fields (url or state) into a 512-byte stack buffer using memcpy, with the length derived from the source st...

PT-2018-16261 · Samsung · Samsung Smartthings Hub

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: A stack-based buffer overflow issue exists in the samsungWifiScan callback notification of the video-core's HTTP server. The video-core process incorrectly handles answers from ...

PT-2018-16303 · Samsung · Samsung Smartthings Hub

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: An exploitable HTTP header injection issue exists in the remote servers of the Samsung SmartThings Hub. The hubCore process listens on port 39500 and relays any unauthenticated...

Samsung SmartThings Hub hubCore ZigBee firmware update CRC16 check denial-of-service vulnerability

Summary An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of the Samsung SmartThings Hub. The hubCore process incorrectly handles malformed files existing in its “data” directory, leading to an infinite loop, which eventually causes...

graphics.ethz.ch XSS vulnerability

Open Bug Bounty ID: OBB-627464 Description| Value ---|--- Affected Website:| graphics.ethz.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Coinbase: ETH contract handling errors

A business logic error in the ETH contract handling code allowed for a nested revert call in contract execution to improperly credit a user account though funds had not been transferred. In addition, the code did not appropriately handle delegatecall within a contract. Sample contract for the fir...

emerson.arch.ethz.ch XSS vulnerability

Open Bug Bounty ID: OBB-573925 Description| Value ---|--- Affected Website:| emerson.arch.ethz.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ra.ethz.ch XSS vulnerability

Open Bug Bounty ID: OBB-560411 Description| Value ---|--- Affected Website:| ra.ethz.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Joomla Zh BaiduMap 3.0.0.1 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications input name="id" value="-11 UNION ALL SELECT...

Joomla Zh GoogleMap 8.4.0.0 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications input name="id" value="-11 UNION ALL SELECT...

PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH

CVSS v3 8.2 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: PHOENIX CONTACT Equipment: FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH Vulnerability: Cross-site Scripting AFFECTED PRODUCTS The following models running firmware versions prior to 1.99, 2.20, or 2.40 of FL...

Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal

!/usr/bin/env python -- coding: UTF-8 -- github.com/tintinweb optional: pip install pysocks https://pypi.python.org/pypi/PySocks ''' API overview: nc -L -p 3333 "id":0,"jsonrpc":"2.0","method":"minergetstat1" "id":0,"jsonrpc":"2.0","method":"minerfile","params":"epools.txt",""...