CVE-2017-9479

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to execute arbitrary commands as root by leveraging local network access and connecting to the syseventd server, as demonstrated by copying configuration data into a...

Fusion K2 wireless router suffers from an override access vulnerability

The Fusion K2 PSG1218 router is a new generation of wireless routers for entry-level users. The Fusion K2 wireless router is vulnerable to an override access vulnerability. An attacker can use the vulnerability to obtain the details of all end devices in the LAN without logging in, and also perfo...

Microsoft Windows Kernel - IOCTL 0x120007 NsiGetParameter nsiproxynetio Pool Memory Disclosure

Microsoft Windows Kernel - IOCTL 0x120007 NsiGetParameter nsiproxynetio Pool Memory Disclosure / We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys \.\Nsi device discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment...

CVE-2016-7811

Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations via unspecified vectors...

CVE-2015-6586

The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network...

CVE-2016-4863

The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II...

CVE-2017-2681

Specially crafted PROFINET DCP packets sent on a local Ethernet segment Layer 2 to an affected product could cause a denial of service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected...

ASUS Patches RT Router Vulnerabilities

A recent ASUS firmware update addressed a number of vulnerabilities in 30 models of its popular RT routers. The flaws were privately disclosed by researchers at Baltimore consultancy Nightwatch Cybersecurity, and were patched starting in March, with 10 updates added Wednesday. Users should ensure...

Code injection

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

UBUNTU-CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

CVE-2017-5042

CVE-2017-5042 affects Chromium/Google Chrome before version 57.0.2987.98 (desktop) and 57.0.2987.108 (Android) due to incorrect handling of cookies in Cast, enabling a local‑network attacker to cause connections to arbitrary URLs and observe plaintext cookies. Public advisories (Debian, openSUSE)...

CVE-2017-5042

Removed by vendor...

CVE-2016-7834

SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521, SNC-ZB550, SNC-ZM550, SNC-ZM551, SNC-EP550, SNC-EP580, SNC-ER550, SNC-ER550C, SNC-ER580, SNC-ER585, SNC-ER585H, SNC-ZP550, SNC-ZR550,...

CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

Slack: Bypass to postMessage origin validation via FTP

@a1kmm- discovered a bypass to our postMessage origin check, wherein an attacker with existing MITM capabilities could use FTP to bypass validation and view XOXS tokens of victims on the local network. This was related to, and investigated at the same time as, a previous report. This issue is now...

CVE-2016-6085

IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers...

CVE-2016-6085

IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers...

Code injection

IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers...

CVE-2016-6085

IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers...

CVE-2016-6085

IBM BigFix Platform (BES Root Server and BES Relay) on the local network is affected by a Denial of Service vulnerability (CVE-2016-6085) due to improper handling of unspecified user-supplied input, which could cause the BES and relay servers to crash. Related advisories reference this alongside ...