PT-2020-16398

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 3.5.1 Description The issue arises from problems in Go's standard library XML parsing, allowing an attacker to mutate a valid SAML response and modify the trusted document. This can result in allowing unverified logins...

X (Formerly Twitter): Read-only application can publish/delete fleets

Summary: Twitter released Fleet yesterday. This feature is working with few APIs, and these APIs are missing permission checks. Description: In /fleets/v1/create of https://api.twitter.com, there is no check to whether if the application has permission to write to the account. /fleets/v1/delete h...

2017 Tesla Hack

Interesting story of a class break against the entire Tesla fleet...

2017 Tesla Hack

Interesting story of a class break against the entire Tesla fleet...

2017 Tesla Hack

Interesting story of a class break against the entire Tesla fleet...

CVE-2020-10269

One of the wireless interfaces within MiR100, MiR200 and possibly according to the vendor other MiR fleet vehicles comes pre-configured in WiFi Master Access Point mode. Credentials to such wireless Access Point default to well known and widely spread SSID MiRRXXXX and passwords omitted. This...

CVE-2020-10269

One of the wireless interfaces within MiR100, MiR200 and possibly according to the vendor other MiR fleet vehicles comes pre-configured in WiFi Master Access Point mode. Credentials to such wireless Access Point default to well known and widely spread SSID MiRRXXXX and passwords omitted. This...

Hardcoded credentials

Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users omitted and passwords omitted. This...

CVE-2020-10270 RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard

Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users omitted and passwords omitted. This...

CVE-2020-10270

CVE-2020-10270 affects MiR robotic fleet (MiR100/MiR200, potentially others) where the Control Dashboard is reachable on a hardcoded IP via wired/wireless interfaces. The flaw enables control of the robot through default, widely known credentials, as documented in past guides, and may be extended...

PT-2020-12018

Name of the Vulnerable Software and Affected Versions MiR100 affected versions not specified MiR200 affected versions not specified MiR250 affected versions not specified MiR500 affected versions not specified MiR1000 affected versions not specified Description A wireless interface in certain MiR...

CVE-2018-19798

Fleetco Fleet Maintenance Management FMM 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidentsadd.php?submit=1 URI, as demonstrated by the valueImages1 field, which leads to remote command execution on the remote server. Any authenticat...

CVE-2018-19798

Fleetco Fleet Maintenance Management FMM 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidentsadd.php?submit=1 URI, as demonstrated by the valueImages1 field, which leads to remote command execution on the remote server. Any authenticat...

CVE-2018-19798

The CVE-2018-19798 entry applies to Fleetco Fleet Maintenance Management (FMM) ≤1.2. An authenticated user can upload an arbitrary .php file (via accidents_add.php?submit=1, value_Images_1) with Content-Type application/x-php, leading to remote command execution on the remote server. The availabl...

CVE-2018-19798: Unrestricted Upload of File with Dangerous Type

Fleetco Fleet Maintenance Management FMM 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidentsadd.php?submit=1 URI, as demonstrated by the valueImages1 field, which leads to remote command execution on the remote server. Any authenticat...

PT-2020-8650

Name of the Vulnerable Software and Affected Versions: Fleetco Fleet Maintenance Management FMM versions 1.2 and earlier Description: The issue allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the "accidents add.php?submit=1" URI, as demonstrated by the value...

Mail.ru: Public available Sensitive Information about drivers

Domain, site, application -- API for client app Citimobil https://c-api.city-mobil.ru/ Version 4.33.0 and others Testing environment -- Device on any OS with internet connection Any software to send https requests Steps to reproduce -- Send POST request to url...

Mail.ru: [https://fleet.city-mobil.ru] Stored XSS into driver mailing

Stored XSS via content of the message to driver in operator's interface...

RedHunt OS v2 - Virtual Machine For Adversary Emulation And Threat Hunting

Virtual Machine for Adversary Emulation and Threat Hunting by RedHunt Labs RedHunt OS aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment. Base Machin...

Man-in-the-Middle (MitM)

Github.Com/Kolide/Fleet is vulnerable to man-in-the-middle MitM. LOGIN authentication is not done using secure TLS connection with SMTP server, leaking login credentials to a man-in-the-middle attacker...