CVE-2017-8405

An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be...

CVE-2017-8409

An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed...

CVE-2017-8409

The CVE-2017-8409 issue affects the D-Link DCS-1130 network camera. A missing authentication check on a specific URL allows an attacker to view the live video feed without credentials, increasing risk given there are many affected devices. The problem is due to inconsistent access restrictions on...

CVE-2017-8409: Improper Authorization

An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed...

WordPress Live Chat Unlimited premium plugin <= 2.8.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by m0ze in WordPress Live Chat Unlimited premium plugin versions = 2.8.3. Solution Update the WordPress Live Chat Unlimited premium plugin to the latest available version at least 2.8.4...

CVE-2019-13052

Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed...

Code injection

Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed...

CVE-2019-13052

Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed...

CVE-2019-13052

CVE-2019-13052 concerns Logitech Unifying devices where, if the pairing between a keyboard and its receiver is sniffed, an attacker could achieve live decryption of the communication. The core details across connected records identify the affected class as Logitech Unifying devices and describe a...

PT-2019-13098

Name of the Vulnerable Software and Affected Versions Logitech Unifying devices affected versions not specified Description The issue allows live decryption of data if the pairing process of a keyboard to a receiver is intercepted. Recommendations At the moment, there is no information about a...

PT-2019-13101

Name of the Vulnerable Software and Affected Versions Logitech Unifying devices affected versions not specified Description The issue allows attackers to dump AES keys and addresses, enabling them to perform live decryption of Radio Frequency transmissions. This has been demonstrated through an...

CVE-2019-13052: Use of a Broken or Risky Cryptographic Algorithm

Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed...

dvips Code Execution

The vulnerability of the dvips application in the TeX Live typesetting system arises from buffer overflows during the processing of command-line parameters. Exploiting this vulnerability can allow an attacker to cause a malfunction of the application or execute arbitrary code by entering a...

WordPress Plugin Live Chat Unlimited Cross-Site Scripting Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site scripting vulnerability exists in the WordPress plugin Live Chat Unlimited,...

Live Chat Unlimited <= 2.8.3 - Stored Cross-Site Scripting (XSS)

Weak security measures like bad input field data filtering has been discovered in the 'Live Chat Unlimited'. PoC Go to the demo website https://screets.com/try/lcx/night-bird/ and open chat window by clicking on «Open/close» link, then click on «Online mode» to go online. Use your payload inside...

WordPress Live Chat Unlimited 2.8.3 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection Google Dork: inurl:"wp-content/plugins/screets-lcx" Date: 2019/06/25 Exploit Author: m0ze Vendor Homepage: https://screets.com/ Software Link:...

Beers with Talos Ep. #55: Live from San Diego!

Beers with Talos BWT Podcast Ep. 55 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded June 12, 2019 — God knows why, but we bring you another live episode from the Talos Threat Research Summit at Cisco Live...

WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting

WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection Google Dork: inurl:"wp-content/plugins/screets-lcx" Date: 2019/06/25 Exploit Author: m0ze Vendor Homepage: https://screets.com/ Software Link:...

WordPress Live Chat Unlimited 2.8.3 Cross Site Scripting

Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection Google Dork: inurl:"wp-content/plugins/screets-lcx" Date: 2019/06/25 Exploit Author: m0ze Vendor Homepage: https://screets.com/ Software Link: https://codecanyon.net/item/wordpress-live-chat-plugin/3952877 Version: 2.8.3 Tested on:...

iLive <= 1.0.4 - Stored Cross-Site Scripting (XSS)

Info: Weak security measures like bad textarea data filtering has been discovered in the 'iLive - Intelligent WordPress Live Chat Support Plugin'. Current version of this premium WordPress plugin is 1.0.4. Demo Website: https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563...