Hardcoded credentials

/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223P-6, TL-IPC323K-D, TL-IPC325KP-, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password...

CVE-2018-11481

TP-LINK IPC TL-IPC223P-6, TL-IPC323K-D, TL-IPC325KP-, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters...

CVE-2018-11482

/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223P-6, TL-IPC323K-D, TL-IPC325KP-, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password...

CVE-2018-11481

TP-LINK IPC TL-IPC223P-6, TL-IPC323K-D, TL-IPC325KP-, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters...

PT-2018-10600

Name of the Vulnerable Software and Affected Versions TP-LINK IPC versions TL-IPC223P-6, TL-IPC323K-D, TL-IPC325KP-, and TL-IPC40A-4 Description The issue allows authenticated remote code execution via crafted JSON data. This is because the /usr/lib/lua/luci/torchlight/validator.lua file does not...

PT-2018-10601

Name of the Vulnerable Software and Affected Versions TP-LINK IPC devices affected versions not specified Description A hardcoded password zMiVw8Kw0oxKXL0 is present in the /usr/lib/lua/luci/websys.lua file on certain TP-LINK IPC devices. Recommendations For TP-LINK IPC devices, consider changing...

openSUSE Security Update : pdns (openSUSE-2018-532)

This update for pdns fixes the following issues : Security issues fixed : - CVE-2018-1046: Fix an issue with replaying a specially crafted PCAP file that can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution bsc1092540. %NASLMINLEVEL 70300 C Tenabl...

Outpost24 Appsec Scale for Web Application Scanning

Today I would like to write about yet another Outpost24 product - cloud Web Application Scanner Appsec Scale. It is available in the same interface as Outpost24 Outscan, that I reviewed earlier. Select APPSEC SCALE in the start menu and you can scan web applications: New application If you don't...

[SECURITY] Fedora 28 Update: love-0.10.2-12.fc28

LOVE is an open source, cross platform 2D game engine which uses the Lua scripting language. LOVE can be used to make games of any license allowing it to be used for both free and non-free projects...

Redis EVAL Lua Sandbox Escape

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command. TRUSTED...

AutoNSE - Massive NSE (Nmap Scripting Engine) AutoSploit And AutoScanner

Massive NSE Nmap Scripting Engine AutoSploit and AutoScanner. The Nmap Scripting Engine NSE is one of Nmap's most powerful and flexible features. It allows users to write and share simple scripts using the Lua programming language to automate a wide variety of networking tasks. Those scripts are...

Sandcat Browser 6.0 - Pentest And Developer-Oriented Web Browser

Sandcat is a lightweight multi-tabbed web browser that combines the speed and power of Chromium and Lua. Sandcat comes with built-in live headers, an extensible user interface and command line console, resource viewer, and many other features that are useful for web developers and pen-testers and...

Yii Arbitrary LUA Code Execution Vulnerability

Yii is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A security vulnerability exists in version 2.x of Yii before 2.0.15. A remote attacker can exploit this vulnerability to execute arbitrary LUA code...

CVE-2018-8073

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

CVE-2018-8073

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

CVE-2018-8073

The CVE-2018-8073 entry affects Yii 2.x prior to 2.0.15. Affected component: framework/db/ActiveRecord.php, specifically findByCondition via findOne/findAll, enabling remote SQL injection by manipulating input (undocumented sanitization considerations) and potentially bypassing access checks. Thi...

CVE-2018-8073

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

PT-2018-18419

Name of the Vulnerable Software and Affected Versions: Yii versions prior to 2.0.15 yii2-redis affected versions not specified Description: The issue allows remote attackers to execute arbitrary LUA code, potentially leading to remote code execution in the LUA context of the Redis server. This ca...

CVE-2018-8073: Improper Control of Generation of Code

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

Potential remote code execution in LUA context of the redis server via methods `yii\redis\ActiveRecord::findOne()` and `::findAll()`

More info at https://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/...