5440 matches found
CVE-2018-14852
CVE-2018-14852 concerns the Samsung Galaxy S6 SM-G920F with the bcmdhd4358 Wi‑Fi driver. The issue is an out-of-bounds array access in the dhd_rx_frame function (drivers/net/wireless/bcmdhd4358/dhd_linux.c) caused by improper validation of the network interface index reported by the Wi‑Fi chip fi...
CVE-2018-14855
The CVE refers to a buffer overflow in the bcmdhd4358 Wi‑Fi driver (Samsung Galaxy S6) specifically in the dhd_pcie.c functions dhd_bus_flow_ring_flush_response and related flow/control ring handling. Affected device: Galaxy S6 with the bcmdhd4358 driver (SM-G920F/G920FXXU5EQH7). Root cause: buff...
CVE-2018-14854
CVE-2018-14854 concerns a buffer overflow in the bcmdhd4358 Wi‑Fi driver (drivers/net/wireless/bcmdhd4358/dhd_pcie.c) on the Samsung Galaxy S6 (SM-G920F, firmware G920FXXU5EQH7). The flaw occurs in the dhd_bus_flow_ring_delete_response path and allows an attacker with code execution on the Wi‑Fi ...
CVE-2018-14854
Buffer overflow in dhdbusflowringdeleteresponse in drivers/net/wireless/bcmdhd4358/dhdpcie.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allow an attacker who has obtained code execution on the Wi-Fi chip to cause the device driver to perform invalid memory...
CVE-2018-14853
The CVE-2018-14853 issue affects the Samsung Galaxy S6 (SM-G920F, firmware G920FXXU5EQH7) and specifically the bcmdhd4358 Wi‑Fi driver. A NULL pointer dereference in dhd_prot_txdata_write_flush (drivers/net/wireless/bcmdhd4358/dhd_msgbuf.c) can be triggered by an attacker who has code execution o...
CVE-2018-14855
Buffer overflow in dhdbusflowringflushresponse in drivers/net/wireless/bcmdhd4358/dhdpcie.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 allow an attacker who has obtained code execution on the Wi-Fi chip to cause the device driver to perform invalid memory accesses. The Samsung ID is...
CVE-2018-14853
A NULL pointer dereference in dhdprottxdatawriteflush in drivers/net/wireless/bcmdhd4358/dhdmsgbuf.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker who has obtained code execution on the Wi-Fi chip to cause the device to reboot. The Samsung ID is...
Transcend Wi-Fi SD Card Cross Site Request Forgery / Traversal Vulnerabilities
Transcend Wi-Fi SD Card 16GB with firmware 1.8 suffers from cross site request forgery and directory traversal vulnerabilities. There are Directory Traversal and Cross-Site Request Forgery vulnerabilities in Transcend Wi-Fi SD Card. ------------------------- Affected products:...
Transcend Wi-Fi SD Card Cross Site Request Forgery / Traversal
Hello list! There are Directory Traversal and Cross-Site Request Forgery vulnerabilities in Transcend Wi-Fi SD Card. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Transcend Wi-Fi SD Card 16 GB, Firmware v.1.8. This model with other firmware...
Code injection
A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...
CVE-2018-20161
A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...
CVE-2018-20161
CVE-2018-20161 concerns the BlinkForHome Sync Module (2.10.4 and earlier). The vulnerability is a design flaw that allows an attacker to disable cameras via Wi‑Fi because incident clips tied to motion-sensor events aren’t saved if the attacker’s traffic (e.g., Dot11Deauth) disconnects the Sync Mo...
CVE-2018-20161
A design flaw in the BlinkForHome aka Blink For Home Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips triggered by the motion sensor are not saved if the attacker's traffic such as Dot11Deauth successfully disconnects the Sync Module from the...
Framework for Rogue Wi-Fi Access Point Attack: WiFi-Pumpkin
The WiFi-Pumpkin is a rogue AP framework to easily create these fake networks, all while forwarding legitimate traffic to and from the unsuspecting target. It comes stuffed with features, including rogue Wi-Fi access points, deauth attacks on client APs, a probe request and credentials monitor,...
Design/Logic Flaw
Mishandling of '' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service crash and reboot via certain ONVIF methods such as CreateUsers, SetImagingSettings, GetStreamUri, and so on...
Design/Logic Flaw
Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service crash and reboot via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method...
CVE-2018-20051
Mishandling of '' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service crash and reboot via certain ONVIF methods such as CreateUsers, SetImagingSettings, GetStreamUri, and so on...
CVE-2018-20050
Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service crash and reboot via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method...
CVE-2018-20050
Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service crash and reboot via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method...
CVE-2018-20050
The CVE-2018-20050 vulnerability affects the Jooan JA-Q1H Wi‑Fi camera (firmware 21.0.0.91). A mishandling of an empty string in ONVIF GetStreamUri and GetVideoEncoderConfigurationOptions can allow a remote attacker to cause a denial of service (crash and reboot) over the network without authenti...