Multiple I-O DATA network camera products vulnerable to cross-site request forgery

Overview Multiple network camera products provided by I-O DATA DEVICE, INC. contains a cross-site request forgery vulnerability CWE-352. Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Securi...

JVN#65411235: Multiple I-O DATA network camera products vulnerable to cross-site request forgery

Multiple network camera products provided by I-O DATA DEVICE, INC. contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the Firmware Apply the appropriate firmware update...

JVN#24348065: Multiple vulnerabilities in HOME SPOT CUBE2

HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains multiple vulnerabilities listed below. OS command injection in Clock Settings CWE-78 - CVE-2017-2183 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H| Base Score...

Vulnerability Spotlight: Multiple Foscam C1 Vulnerabilities Come in to Focus

Executive SummaryThe Foscam C1 is a webcam that is marketed for use in a variety of applications including home security monitoring. As an indoor webcam, it is designed to be set up inside of a building and features the ability to be accessed remotely via a web interface or from within a mobile...

Cambium Networks ePMP

CVSS v3 7.6 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Cambium Networks Equipment: ePMP Vulnerabilities: Improper Access Control, Improper Privilege Management AFFECTED PRODUCTS Cambium reports that the vulnerabilities affect the following ePMP Network Access Control...

Apache Struts Open Source Framework Remote Code Execution - us

Lenovo Security Advisory: LEN-14200 Potential Impact: Remote code execution Scope of Impact: Industry-Wide CVE Identifier: CVE-2017-5638 Summary Description: Lenovo V3700 V2, Lenovo V3700 V2 XP, Lenovo V5030/V5030F and Storwize V7000 for Lenovo storage devices contain a vulnerability in Apache...

Apache Struts Open Source Framework Remote Code Execution - Lenovo Support US

No description provided...

PT-2017-3602 · D Link · Dir-865L +3

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L versions prior to DIR868LA1 FW112b04 D-Link DIR-865L versions prior to DIR-865L REVA FIRMWARE PATCH 1.08.B01 D-Link DIR-880L versions prior to DIR-880L REVA FIRMWARE PATCH 1.08B04 D-Link DIR-860L versions prior to DIR860LA1...

Brocade Fibre Channel SAN Privilege Escalation - us

Lenovo Security Advisory: LEN-14794 Potential Impact: Local privilege escalation Severity: High Scope of Impact: Industry-Wide CVE Identifier: CVE-2016-8202 Summary Description: A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS FOS releases earli...

Peplink Balance Routers Multiple Vulnerabilities

Peplink Balance routers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:peplink:balance"; ...

Phoenix Broadband Technologies LLC PowerAgent SC3 Site Controller

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Phoenix Broadband Technologies LLC Equipment: PowerAgent SC3 Site Controller Vulnerability: Use of Hard-Coded Password AFFECTED PRODUCTS Phoenix Broadband Technologies LLC reports that the following versions of...

Netgear Now Collects Router 'Analytics Data' — Here’s How to Disable It

Is your router collects data on your network? Netgear last week pushed out a firmware update for its wireless router model NightHawk R7000 with a remote data collection feature that collects router's analytics data and sends it to the company's server. For now, the company has rolled out the...

Hanwha Techwin SRN-4000

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Hanwha Techwin Equipment: SRN-4000 Vulnerability: Unauthenticated Access AFFECTED PRODUCTS The following versions of SRN-4000, a network video management platform, are affected: SRN-4000 firmware versions prior to...

Google Nexus 9 Cypress SAR Firmware Injection via I2C(CVE-2017-0563)

Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a sensor SoC manufactured by Cypress. The sensor is manag...

Google Nexus Synaptics Touchscreen Firmware Injection(CVE-2017-0433)

Products Nexus 6P Nexus 9 Android One Pixel Pixel XL Vulnerable Versions Verified on Nexus 9 6.0.1/MOB30W Verified on Nexus 9 7.0/NRD90M Technical Details Due to lenient SELinux and DAC policy, vulnerable Synaptics DSX touchscreen driver sysfs file entires are exposed to an attacker that executes...

ASUS Routers CSRF / Information Disclosure Vulnerabilities

ASUS routers suffer from cross site request forgery and information disclosure vulnerabilities. Versions affected include RT-AC55U, RT-AC56R, RT-AC56S, RT-AC56U, RT-AC66U, RT-AC88U, RT-AC66R, RT-AC66U, RT-AC66W, RT-AC68W, RT-AC68P, RT-AC68R, RT-AC68U, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC53U,...

ASUS Routers CSRF / Information Disclosure

Original post here: https://wwws.nightwatchcybersecurity.com/2017/05/09/multiple-vulnerabilities-in-asus-routers/ Summary Various models of ASUS RT routers have several CSRF vulnerabilities allowing malicious sites to login and change settings in the router; multiple JSONP vulnerabilities allowin...

Intel Patches Nine-Year-Old Critical CPU Vulnerability

Intel patched a critical vulnerability that dates back nine years and impacts business desktop PCs that utilize the company’s Active Management Technology. According to an Intel security bulletin, the flaw could allow an adversary to elevate privileges on a vulnerable system. Intel said there are...

Intel Active Management Technology (AMT) does not properly enforce access control

Overview Technologies based on Intel Active Management Technology may be vulnerable to remote privilege escalation, which may allow a remote, unauthenticated attacker to execute arbitrary code on the system. Description CWE-284: Improper Access Control - CVE-2017-5689Intel offers a number of...

GE Multilin SR, UR, and URplus Protective Relays (Update A)

CVSS v3 8.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: GE Equipment: Multilin SR, UR, and URplus Protective Relays Vulnerabilities: Weak Cryptography for Passwords UPDATED INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-117-01 GE...