CVE-2018-15840

CVE-2018-15840 affects TP-Link TL-WR840N devices: a vulnerability in processing fragmented packets can be exploited remotely to cause a denial of service (network outage). Demonstrated by sending fragmented packets (e.g., with nmap -f). The provided connected documents corroborate a DoS impact vi...

Design/Logic Flaw

Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small...

CVE-2019-9555

CVE-2019-9555 affects Sagemcom F@st 5260 routers (firmware 0.4.39 and possibly others) where WPA PSKs are derived from a two-part wordlist plus a nonce with insufficient entropy. This yields roughly 1.78 billion possible PSKs, making the WPA key space far smaller than expected and enabling potent...

Fiberhome AN5506-04-F RP2669 Cross Site Scripting

Exploit Title: Fiberhome AN5506-04-F - Stored Cross Site Scripting Date: 04.03.2019 Exploit Author: Tauco Vendor Homepage: http://www.fiberhomegroup.com/en/ Version: RP2669 Tested on: Windows 10 CVE : CVE-2019-9556 Description:...

CVE-2019-9555: Insufficient Entropy

Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small...

PT-2019-19706

Name of the Vulnerable Software and Affected Versions Sagemcom F@st 5260 version 0.4.39 Description The issue concerns the generation of a Pre-Shared Key PSK in WPA mode, which is derived from a 2-part wordlist of known values and a nonce with insufficient entropy. This results in a limited numbe...

Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications...

Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting

Exploit Title: Fiberhome AN5506-04-F - Stored Cross Site Scripting Date: 04.03.2019 Exploit Author: Tauco Vendor Homepage: http://www.fiberhomegroup.com/en/ Version: RP2669 Tested on: Windows 10 CVE : CVE-2019-9556 Description:...

PT-2019-19364

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=content&f=postinfo&v=listing&set iframe=" API endpoint, which is connected to the...

PT-2019-19361

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=attachment&f=imagecut&v=init&imgurl=" endpoint, which is connected to the...

PT-2019-19363

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=message&f=message&v=add" endpoint, specifically with the username variable. Recommendations For WUZHI CM...

PT-2019-19362

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue exists due to a cross-site scripting XSS flaw. This flaw can be exploited via the index.php endpoint, specifically through the m, f, v, x, and y parameters. The vulnerable endpoint is...

Debian DSA-4387-1 : openssh - security update

Harry Sintonen from F-Secure Corporation discovered multiple vulnerabilities in OpenSSH, an implementation of the SSH protocol suite. All the vulnerabilities are in found in the scp client implementing the SCP protocol. - CVE-2018-20685 Due to improper directory name validation, the scp client...

[SECURITY] [DSA 4387-1] openssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4387-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez February 09, 2019 https://www.debian.org/security/faq -...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20572: Improper Neutralization of Special Elements used in an SQL Command

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

PT-2018-15442

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue allows SQL injection via the keywords parameter in the "index.php?m=promote&f=index&v=search" endpoint. Recommendations For WUZHI CMS version 4.1.0, avoid using the keywords parameter in the affect...

PT-2018-15232

Name of the Vulnerable Software and Affected Versions PHPok version 5.0.055 Description A Stored XSS issue was found, which can be exploited via the title parameter to the "api.php?c=post&f=save" API endpoint, accessible through the "index.php?id=book" URI. Recommendations For PHPok version...

PT-2018-15007

Name of the Vulnerable Software and Affected Versions PHPok version 4.9.015 Description An issue was discovered that allows remote attackers to execute arbitrary code. This is achieved through the "Login Background Program Upgrade Compressed Packet Upgrade" action, where a .php file is placed...

[SECURITY] Fedora 28 Update: kde-connect-1.3.3-1.fc28

KDE Connect adds communication between KDE and your smartphone. Currently, you can pair with your Android devices over Wifi using the KDE Connect 1.0 app from Albert Vaka which you can obtain via Google Play, F-Droid or the project website...