CVE-2021-21960

CVE-2021-21960 affects Sealevel Systems SeaConnect 370W v1.3.34, impacting LLMNR and NBNS. The TALOS report documents a stack-based buffer overflow in both LLMNR and NBNS handlers, where a length field is copied into a fixed 32-byte buffer without bounds checking, allowing a attacker-controlled j...

CVE-2021-29393

Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled "command" and "commandvalues" parameters...

CVE-2021-29395

Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application...

CVE-2021-29396

Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication...

Cross site request forgery (csrf)

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST...

Design/Logic Flaw

Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP...

Directory traversal

Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application...

CVE-2021-29397

CVE-2021-29397 affects Northstar Technologies Inc. NorthStar Club Management version 6.3. The vulnerability is a cleartext transmission issue in the login page at /northstar/Admin/login.jsp, allowing a remote observer to intercept credentials transmitted over HTTP. The connected documents confirm...

CVE-2021-29396

Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication...

CVE-2021-29396

CVE-2021-29396 concerns NorthStar Club Management 6.3 from Northstar Technologies Inc, described as a systemic insecure-permissions issue that allows remote unauthenticated users to access and use various functionalities without authentication. The CVE entry notes exposure at network level with h...

CVE-2021-29394

CVE-2021-29394 affects NorthStar Club Management version 6.3. The issue is a lack of proper authorization in the userID parameter of an HTTP POST to /northstar/Admin/changePassword.jsp, allowing remote authenticated users to change other users’ passwords (account hijacking). Root cause: insuffici...

CVE-2021-29393

The CVE-2021-29393 entry concerns Northstar Club Management 6.3. Affected component: web interfaces cominput.jsp and comoutput.jsp. Root cause: unsanitized user-controlled parameters command and commandvalues enable an OS command injection, allowing remote unauthenticated users to inject and exec...

CVE-2021-29393

Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled "command" and "commandvalues" parameters...

GSD-2022-1000071 Default Credentials in XB6 Fibre+ Gateway version XB6_0821

In Shaw Communications Inc XB6 Fibre+ Gateway version XB60821 a Default Credentials exists in the Router/Modem that can be attacked via local access resulting in Admin access to router...

CAN-2022-1000071 Default Credentials in XB6 Fibre+ Gateway version XB6_0821

In Shaw Communications Inc XB6 Fibre+ Gateway version XB60821 a Default Credentials exists in the Router/Modem that can be attacked via local access resulting in Admin access to router...

Sealevel Systems, Inc. SeaConnect 370W Web Server information disclosure vulnerability

Summary An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger...

Sealevel Systems, Inc. SeaConnect 370W LLMNR/NBNS stack-based buffer overflow vulnerabilities

Summary A stack-based buffer overflow vulnerability exists in both the LLMNR and NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger either of the...

Sealevel Systems, Inc. SeaConnect 370W OTA update task file overwrite vulnerability

Summary A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Tested Version...

Sealevel Systems, Inc. SeaConnect 370W MQTTS Certificate Validation vulnerability

Summary A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality. Tested Versions Sealevel Systems, Inc. SeaConnect 370...

Dell EMC Data Protection Central Input Validation Error Vulnerability

Dell Emc Data Protection Central is a management console from Dell USA Inc. It is used for data protection. A security vulnerability exists in Dell EMC Data Protection Central that originates from a network system or product that does not properly validate incoming data. No details of the...