4242 matches found
HomeAutomation v3.3.2 CSRF Add Admin Exploit
Summary HomeAutomation is an open-source web interface and scheduling solution. It was initially made for use with the Telldus TellStick, but is now based on a plugin system and except for Tellstick it also comes with support for Crestron, OWFS and Z-Wave using OpenZWave. It controls your devices...
Thrive Smart Home v1.1 SQL Injection Authentication Bypass
Summary As smart home technology becomes more affordable and easy to install with services offered by Thrive Smart Homes, there are some great options available to give your home a high-tech makeover. If the convenience of feeding your cat or turning on your air conditioning with a tap on your...
Thrive Smart Home v1.1 Reflected Cross-Site Scripting
Summary As smart home technology becomes more affordable and easy to install with services offered by Thrive Smart Homes, there are some great options available to give your home a high-tech makeover. If the convenience of feeding your cat or turning on your air conditioning with a tap on your...
AVE DOMINAplus <=1.10.x Authentication Bypass Exploit
Summary DOMINAplus - Sistema Domotica Avanzato. Advanced Home Automation System. Designed to revolutionize your concept of living. DOMINA plus is the AVE home automation proposal that makes houses safer, more welcoming and optimized. In fact, our home automation system introduces cutting-edge...
AVE DOMINAplus <=1.10.x Credentials Disclosure Exploit
Summary DOMINAplus - Sistema Domotica Avanzato. Advanced Home Automation System. Designed to revolutionize your concept of living. DOMINA plus is the AVE home automation proposal that makes houses safer, more welcoming and optimized. In fact, our home automation system introduces cutting-edge...
A week in security (December 16 – 22)
Last week on Malwarebytes Labs, we signalled that Mac threat detections have been on the rise in 2019, discussed how a new Consumer Online Privacy Rights Act COPRA would empower American users, warned that the Spelevo exploit kit debuts a new social engineering trick, and let our own Statler and...
Deutsche Bahn Ticket Vending Machine Privilege Escalation
Document Title: =============== Deutsche Bahn Ticket Vending Machine Windows XP - Local Kiosk Privilege Escalation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2191 Vulnerability Magazine:...
GitHub Security Lab: Netty HTTP Response Splitting (CRLF Injection) due to disabled header validation
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query to detect insecure MaxLengthRequest values in ASP.NET applications
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query to detect pages with validationRequest disabled
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Adds CodeQL query to check for insecure RequestValidationMode in ASP.NET
This bug was reported directly to GitHub Security Lab...
lab-ipay.invacare.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1042600 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
LifeLabs Paid Hackers to Recover Stolen Medical Data of 15 Million Canadians
LifeLabs, the largest provider of healthcare laboratory testing services in Canada, has suffered a massive data breach that exposed the personal and medical information of nearly 15 million Canadians customers. The company announced the breach in a press release posted on its website, revealing...
CVE-2019-12414
In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab...
PYSEC-2019-173
In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab...
Inim Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF
Summary SmartLiving anti-intrusion control panel and security system provides important features rarely found in residential, commercial or industrial application systems of its kind. This optimized-performance control panel provides first-rate features such as: graphic display, text-to-speech,...
Inim Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials
Summary SmartLiving anti-intrusion control panel and security system provides important features rarely found in residential, commercial or industrial application systems of its kind. This optimized-performance control panel provides first-rate features such as: graphic display, text-to-speech,...
[slackware-security] mozilla-firefox
New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.3.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...
Analysing the Attack Surface of an Industrial Data Acquisition Device
Introduction The Data Station Plus from Red Lion Controls was handed to me to analyse the attack surface. The device is designed to connect to SCADA data acquisition devices over Modbus, Profibus, etc. by Serial or Ethernet connection. Data is collected and recorded to a local compact flash card...
Carlo Gavazzi SmartHouse Webapp 6.5.33 CSRF/XSS Vulnerabilities
Summary Carlo Gavazzi is an international company that develops, manufactures and sells electrical automation components. Our products are used in industrial automation and real estate automation. Smart-house is based on a system that we have developed and produced since 1986, mainly for...