CVE-2021-44310

Summary: CVE-2021-44310 affects Firmware Analysis and Comparison Tool (FACT) v3.2. With administrator privileges, an attacker can perform stored XSS by injecting JavaScript/HTML through the user creation functionality. The vulnerability arises from insufficient data validation/filtering of user-s...

CVE-2021-44310

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker could perform stored XSS attacks by inserting JavaScript and HTML code in user creation functionality...

Firmware Analysis and Comparison Tool 跨站请求伪造漏洞

Firmware Analysis and Comparison Tool FACT is a firmware analysis and comparison tool. firmware Analysis and Comparison Tool version v3.2 contains a cross-site request forgery vulnerability that stems from a WEB application that does not adequately validate that the request is from a trusted user...

Firmware Analysis and Comparison Tool 跨站脚本漏洞

Firmware Analysis and Comparison Tool FACT, a firmware analysis and comparison tool, is vulnerable to a cross-site scripting vulnerability in Firmware Analysis and Comparison Tool v3.2. The vulnerability stems from a lack of data validation filtering of user-supplied data and output in the user...

Microsoft acquires ReFirm Labs to enhance IoT security

Modern computing devices can be thought of as a collection of discrete microprocessors each with a dedicated function like high-speed networking, graphics, Disk I/O, AI, and everything in between. The emergence of the intelligent edge has accelerated the number of these cloud-connected devices th...

Microsoft acquires ReFirm Labs to enhance IoT security

Modern computing devices can be thought of as a collection of discrete microprocessors each with a dedicated function like high-speed networking, graphics, Disk I/O, AI, and everything in between. The emergence of the intelligent edge has accelerated the number of these cloud-connected devices th...

Exploit for External Control of System or Configuration Setting in Dlink Dsl-2750U_Firmware

firmware-analysis 1. DS...

Exploit for External Control of System or Configuration Setting in Dlink Dsl-2750U_Firmware

firmware-analysis 1. DS...

Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)

In 2019, Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user. Specifically, Mandiant’s research focused on SolarCity’s now owned by Tesla rebranded ConnectPort X2e device...

‘Insight’ into Home Automation Reveals Vulnerability in Simple IoT Product

ARCHIVED STORY ‘Insight’ into Home Automation Reveals Vulnerability in Simple IoT Product By Douglas McKee · August 18, 2020 Eoin Carroll, Charles McFarland, Kevin McGrath, and Mark Bereza contributed to this report. The Internet of Things promises to make our lives easier. Want to remotely turn...

Firmware Analysis and Comparison Tool Cross-Site Scripting Vulnerability

Firmware Analysis and Comparison Tool FACT is a firmware analysis and comparison tool. A cross-site scripting vulnerability exists in Firmware Analysis and Comparison Tool FACT version 3. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...

CVE-2020-11499

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...

CVE-2020-11499

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...

Cross site scripting

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...

CVE-2020-11499

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...

CVE-2020-11499

FACT 3 from Firmware Analysis and Comparison Tool shows a Stored XSS vulnerability when updating analysis details via a localhost web request, caused by mishandling of the tags and version fields in helperFunctions/mongo_task_conversion.py. This is corroborated by multiple CVE references (NVD, Re...

Measuring the Security of IoT Devices

In August, CyberITL completed a large-scale survey of software security practices in the IoT environment, by looking at the compiled software. Data Collected: 22 Vendors 1,294 Products 4,956 Firmware versions 3,333,411 Binaries analyzed Date range of data: 2003-03-24 to 2019-01-24 varies by vendo...

CVE-2019-9681

Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include:...

CVE-2019-12103 – Analysis of a Pre-Auth RCE on the TP-Link M7350, with Ghidra!

TL;DR The TP-Link M7350 V3 is affected by a pre-authentication CVE-2019-12103, and a few post-authentication CVE-2019-12104 command injection vulnerabilities. These injections can be exploited remotely, if the attacker is on the same LAN or otherwise able to get access to the router web interface...

CVE-2017-8226

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a...