Foscam Indoor IP Camera C1 SeriesCGIProxy.fcgi SMTP Test Password Parameter Configuration Command Injection Vulnerability

Foscam Indoor IP Camera C1 Series is a C1 series wireless IP camera product from Foscam China. A security vulnerability exists in the web management interface of the Foscam Indoor IP Camera C1 Series using the 2.52.2.37 application firmware. The vulnerability can be exploited to inject arbitrary...

Foscam Indoor IP Camera C1 Series Command Execution Vulnerability

Foscam Indoor IP Camera C1 Series is a C1 series wireless IP camera product from Foscam China. A security vulnerability exists in the web management interface of the Foscam Indoor IP Camera C1 Series using application firmware 2.52.2.37. The vulnerability can be exploited to inject arbitrary data...

Foscam Indoor IP Camera C1 Series Command Injection Vulnerability

Foscam Indoor IP Camera C1 Series is a C1 series wireless IP camera product from Foscam China. A security vulnerability exists in the web management interface of the Foscam Indoor IP Camera C1 Series using the 2.52.2.37 application firmware. The vulnerability can be exploited to inject arbitrary...

Huawei Vicky-AL00A and Victoria-AL00A cell phones isub denial of service vulnerability

The Huawei Vicky-AL00A and Victoria-AL00A are both smartphone devices from the Chinese company Huawei Huawei. A denial of service vulnerability exists in the lsub service in the Huawei Vicky-AL00A Vicky-AL00AC00B157 prior and Victoria-VL00A Victoria-VL00AC00B157 prior, which stems from a program...

IBM Sterling B2B Integrator suffers from an unspecified cross-site scripting vulnerability (CNVD-2017-15845)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...

HOME SPOT CUBE2 vulnerable to improper authentication in WebUI

Overview HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains improper authentication in WebUI. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

CVE-2017-6670

A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.17ER1...

Foscam camera ONVIF SetHostname Stored Cross-Site Scripting Vulnerability

Foscam camera is a webcam that pushes messages to your phone and also enables video Baidu cloud storage directly via WIFI. A stored cross-site scripting vulnerability exists in Foscam camera ONVIF SetHostname. An unauthenticated attacker is able to trigger a persistent cross-site scripting attack...

Sunell IPCAMERA IPR54/14AKDN(II)/13 Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Sunell IPCAMERA IPR54/14AKDNII/13 1 Vendor: Shenzhen Sunell Technology Corporation CSNC ID: CSNC-2017-010 Subject: Reflected Cross-Site Scripting Risk: High Effect: Remotely exploitable Author: Stephan Sekula...

Cisco Remote Expert Manager Information Disclosure Vulnerability

Cisco Remote Expert Manager Software is the United States Cisco Cisco a remote management software. The software remote screen sharing, screen annotation and session recording and other collaborative functions. Cisco Remote Expert Manager Software has an information disclosure vulnerability in th...

Design/Logic Flaw

There is a debug-interface vulnerability on some Tenda routers FH1202/F1202/F1200: versions before 1.2.0.20. After connecting locally to a router in a wired or wireless manner, one can bypass intended access restrictions by sending shell commands directly and reading their results, or by entering...

CVE-2017-7909

A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client authentication and redirect unauthorized users. Attackers may intercept requests and bypass authentication to access...

Design/Logic Flaw

Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://email protected/ is displayed without a clear UI indication that it is not a resource on the safe.example.com web site...

Cisco Integrated Management Controller Hijacked Session Vulnerability

Cisco Integrated Management Controller IMC is the U.S. Cisco Cisco company a set of tools for the management of the UCS Unified Computing System, which supports HTTP, SSH access, etc., and can be on the server, shutdown and reboot operations. A security vulnerability exists in the session...

The vulnerability of the Cisco Unified Communications Manager system allows a perpetrator to obtain information about the operating system.

The vulnerability in the web interface of the Cisco Unified Communications Manager system exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to obtain information about the operating system through cross-sit...

Cisco Wireless LAN Controller Denial of Service Vulnerability (CNVD-2017-05525)

The Cisco WLC is responsible for system-wide wireless LAN functions such as security policy, intrusion protection, RF management, quality of service, and mobility. Cisco Wireless LAN Controller WLC version 8.3.102.0, a security vulnerability exists in the Web management interface. An...

D-Link DWR-116 Arbitrary File Download Vulnerability

The DWR-116 is a wireless N300 multi-WAN router from D-Link. An arbitrary file download vulnerability exists in the web interface of the D-Link DWR-116, which can be exploited by a remote attacker to read an arbitrary file via a "GET /uir/" request.... double dot in the "GET /uir/" request to rea...

The vulnerability of the Windows operating system allows a perpetrator to obtain confidential information from the process memory, cause a service failure, or have other adverse effects on the system.

The vulnerability of the Graphical Device Interface GDI in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, acting locally, to obtain confidential information from the process’s memory, cause a service failure...

PT-2017-08: Information Exposure in Hirschmann Automation and Control GmbH Classic Platform Switches

The specialists of the Positive Research center have detected an Information Exposure vulnerability in Hirschmann Automation and Control GmbH Classic Platform Switches. An information exposure through query strings vulnerability in the web interface of Belden Hirschmann RS, RSR, RSB, MACH100,...

CVE-2017-6555

Cross-site scripting XSS vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1description parameter aka "Design Manager Categories Category Description"...