CVE-2019-3989

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when retrieving internal network configuration data...

SuperMicro X8STi-F Operating System Command Injection Vulnerability

The SuperMicro X8STi-F is a computer motherboard from SuperMicro USA. An operating system command injection vulnerability exists in the Virtual Media feature in the SuperMicro X8STi-F with IPMI firmware version 2.06 and BIOS version 02.68. An attacker can exploit this vulnerability to obtain a...

Intel Processors Voltage Settings Modification Advisory - Lenovo Support US

No description provided...

Mersive Solstice 2.8.0 Remote Code Execution

Exploit Title: Mersive Solstice 2.8.0 - Remote Code Execution Google Dork: N/A Date: 2016-12-23 Exploit Author: Alexandre Teyar Vendor Homepage: https://www2.mersive.com/ Firmware Link: http://www.mersive.com/Support/Releases/SolsticeServer/SGE/Android/2.8.0/Solstice.apk Versions: 2.8.0 Tested On...

Mersive Solstice 2.8.0 - Remote Code Execution

Mersive Solstice 2.8.0 - Remote Code Execution Exploit Title: Mersive Solstice 2.8.0 - Remote Code Execution Google Dork: N/A Date: 2016-12-23 Exploit Author: Alexandre Teyar Vendor Homepage: https://www2.mersive.com/ Firmware Link:...

Lenovo ThinkPad USB-C Dock Denial of Service Vulnerability

The Lenovo ThinkPad USB-C Dock is an interface docking station from the Chinese company Lenovo Lenovo. A denial of service vulnerability exists in the Lenovo ThinkPad USB-C Dock with firmware version 3.7.2, which can be exploited by attackers to cause a denial of service...

ZyXEL NBG-418N v2 License Issue Vulnerability

The ZyXEL NBG-418N v2 is a wireless router from Taiwan, China-based ZyXEL. An authorization issue vulnerability exists in the wan.htm page in the Zyxel NBG-418N v2 using firmware version V1.00AARP.9C0. The vulnerability stems from a lack of authentication measures or insufficient authentication...

TP-Link Archer VR300 1 Cross Site Scripting Vulnerability

Exploit for hardware platform in category web applications I. VULNERABILITY ------------------------- Stored XSS Vulnerability on TP-Link Archer VR300 v1 - firmware version: 1.3.0 0.8.0 v007b.1 build 180905 Rel.55344n II. CVE REFERENCE ------------------------- - III. VENDOR...

CVE-2019-15802

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in salutilstrencrypt in libsal.so.0.0. The parameters salt, IV, and key data are used to encrypt and decrypt all passwords using AES256...

Technicolor TD5130.2 - Remote Command Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: Technicolor TD5130.2 - Remote Command Execution Exploit Author: João Teles Vendor Homepage: https://www.technicolor.com/ Version: TD5130v2 Firmware Version: OIFwV20 CVE : CVE-2019-18396 --------------------------- POST...

Technicolor TD5130.2 - Remote Command Execution

Technicolor TD5130.2 - Remote Command Execution Exploit Title: Technicolor TD5130.2 - Remote Command Execution Date: 2019-11-12 Exploit Author: João Teles Vendor Homepage: https://www.technicolor.com/ Version: TD5130v2 Firmware Version: OIFwV20 CVE : CVE-2019-18396 --------------------------- POS...

Optergy Proton/Enterprise BMS 2.3.0a Open Redirect

Open Redirect in Optergy Proton/Enterprise BMS Firmware version: =2.3.0a CVE: CVE-2019-7275 Advisory: https://applied-risk.com/resources/ar-2019-008 Paper: https://applied-risk.com/resources/i-own-your-building-management-system by Gjoko 'LiquidWorm' Krstic GET /updating.jsp?url=https://segfault....

FlexAir Access Control 2.4.9api3 - Remote Code Execution

FlexAir Access Control 2.4.9api3 - Remote Code Execution Exploit Title: FlexAir Access Control 2.4.9api3 - Remote Code Execution Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link:...

FlexAir Access Control 2.4.9api3 - Remote Code Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: FlexAir Access Control 2.4.9api3 - Remote Code Execution Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/...

FlexAir Access Control 2.3.38 Command Injection

!/bin/bash Command injection with root privileges in FlexAir Access Control Prima Systems Firmware version: $OUTPUTFILE" Command injection payload. Be careful with single quotes! PAYLOAD="" Perform exploit echo "Executing: $CMD" curl --silent --output /dev/null -X POST -d "$PAYLOAD"...

Chunghwa Telecom HiNet GPON Arbitrary File Read Vulnerability (CNVD-2019-38472)

Chunghwa Telecom HiNet GPON is an optical modem from Chunghwa Telecom in Taiwan, China. A security vulnerability exists in the Chunghwa Telecom HiNet GPON using firmware prior to I040GWR190731. The vulnerability can be exploited by an attacker to execute commands and read arbitrary files via a...

Chunghwa Telecom HiNet GPON Access Control Flaw Vulnerability

Chunghwa Telecom HiNet GPON is an optical modem from Chunghwa Telecom in Taiwan, China. A security vulnerability exists in the Chunghwa Telecom HiNet GPON using firmware versions prior to I040GWR190731. The vulnerability can be exploited by an attacker to log in to the device without authenticati...

CVE-2019-18202

Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests...

Cisco Expressway Series and Cisco TelePresence Video Communication Server Cross-Site Scripting Vulnerabilities

Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco Corporation.Cisco Expressway Series is an advanced collaboration gateway for unified communications.Cisco TelePresence Video Communication Server is a video communication server. The Cisco...

eQ-3 Homematic CCU3 Session Fixation Vulnerability

The eQ-3 Homematic CCU3 is a central control unit for smart home systems from eQ-3 Germany. A session fixation vulnerability exists in the eQ-3 Homematic CCU3 using firmware version 3.41.11, which can be exploited by an attacker to log in and control the system by creating a session ID and sendin...