Default configuration

Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"...

Information disclosure

Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...

CVE-2017-5238

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

Out-of-bounds

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

CVE-2017-5239

CVE-2017-5239 concerns the Eview EV-07S GPS Tracker, where information disclosure occurs due to a lack of standard encryption when transmitting sensitive data (e.g., GPS data, IMEI) to a centralized monitoring service. The vulnerability implies potential MITM exposure of PII over the network. The...

CVE-2017-5238

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

CVE-2017-5237

CVE-2017-5237 affects the Eview EV-07S GPS Tracker. The issue stems from a lack of authentication, allowing an unauthenticated user who knows the device’s phone number to revert it to factory default via an SMS command (“RESET!”). This corresponds to a high impact on availability (CVSSv3: 7.5) wi...

CVE-2017-5238

The CVE-2017-5238 entry concerns the Eview EV-07S GPS Tracker, where a buffer/overflow happens due to insufficient boundary checks in several input configuration fields. The CNVD entry confirms the root cause as a lack of bounds checking that allows overflowing data from one variable into another...

CVE-2017-5239

Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...

CVE-2017-5238: Improper Restriction of Operations within the Bounds of a Memory Buffer

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

CVE-2017-5239: Inadequate Encryption Strength

Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...

CVE-2017-5237: Improper Authentication

Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"...

Google Chrome to Distrust Symantec SSLs for Mis-issuing 30,000 EV Certificates

Google announced its plans to punish Symantec by gradually distrusting its SSL certificates after the company was caught improperly issuing 30,000 Extended Validation EV certificates over the past few years. The Extended Validation EV status of all certificates issued by Symantec-owned certificat...

BlueZ read-across-the-border vulnerability (CNVD-2016-11953)

BlueZ is an official Bluetooth stack for Linux. A security vulnerability exists in the 'lemetaevdump' function in the tools/parser/hci.c source file of BlueZ version 5.42. An attacker can exploit this vulnerability to read data across boundaries...

UBUNTU-CVE-2016-9803

In BlueZ 5.42, an out-of-bounds read was observed in "lemetaevdump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' which is used to read correct element from 'evlemetastr' array is overflowed...

CVE-2014-2783

CVE-2014-2783 affects Microsoft Internet Explorer 7–11. Description confirms a security feature bypass: IE fails to prevent the use of wildcard EV SSL certificates, enabling remote attackers to spoof a site’s trust level by exploiting an EV certificate issuance issue. Impact described in sources ...

CVE-2014-2783

Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation EV Certificate...

Microsoft Internet Explorer Extended Validation SSL Certificate Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability. An attacker may exploit this issue to bypass EV SSL certificate guidelines by using a wildcard certificate. This may aid in further attacks. Technologies Affected Avaya Aura Conferencing 6.0 SP1 Standard Avaya Au...

CVE-2014-2783: Undefined Security Weakness

Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation EV Certificate...

FreeHost 1.00 - Upload Vulnerability

No description provided by source. ======================================================================================== | Title : FreeHost Version 1.00 Upload Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -0021377181886...