Breaking (bad) firmware encryption. Case study on the Netgear Nighthawk M1

TL;DR The firmware encryption for the Netgear Nighthawk M1 is mainly XOR. It’s possible to derive the XOR key by statistical analysis, just from the firmware update file itself. It’s then possible to extract an AES key from what’s XOR’d, which can be used to decrypt other parts of the firmware...

Apache Tomcat 9.0.0.M1 < 9.0.20 Denial of Service

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 to 9.0.19 or 8.5.0 to 8.5.40. It is, therefore, affected by a denial of service vulnerability due to an incomplete fix for CVE-2019-0199 which did not address HTTP/2 connection window exhaustion on write. Note that the scanner...

PT-2019-12201

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.10 Description The issue allows for XSS via the m1 name parameter in the "Add Article" section under Content - Content Manager - News. Recommendations For CMS Made Simple version 2.2.10, update to a version that fix...

Cross-site scripting in Apache Tomcat

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

CVE-2019-9053

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1idlist parameter...

PT-2019-19339

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.8 Description An issue was discovered in the DesignManager module, specifically in the files action.admin bulk css.php and action.admin bulk template.php. With an unprivileged user having Designer permission, it is...

SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2019:0712-1)

This update for ucode-intel fixes the following issues : Updated to the 20190312 bundle release bsc1129231 New Platforms : AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile CFL-S P0 6-9e-c/22 000000a2 Core Gen9...

Anker Nebula Capsule Pro Denial of Service Vulnerability

The Anker Nebula Capsule Pro is a projector device from Anker Innovations, USA. A security vulnerability exists in the Anker Nebula Capsule Pro NBUIM1V2.1.9 version. An attacker can exploit the vulnerability by sending data to the WifiService with the help of a specially crafted application to...

GHSA-5Q99-F34M-67GC Apache Tomcat Open Redirect vulnerability

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...

CVE-2018-18271

XSS exists in CMS Made Simple version 2.2.7 via the m1extra parameter in an admin/moduleinterface.php "Content--News--Add Article" action...

PT-2018-14388

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.7 Description A security issue exists due to the presence of XSS in the m1 news url parameter. This issue is specifically found in the "Content--News--Add Article" action within the admin/moduleinterface.php file...

PT-2018-14389

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.7 Description A security issue exists due to the presence of XSS in the m1 extra parameter within the "Content--News--Add Article" action in the admin/moduleinterface.php file. Recommendations For CMS Made Simple...

Apache Tomcat 'Hostname Verification' Security Bypass Vulnerability - Windows

Apache Tomcat is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...

Apache Tomcat 8.0.0.RC1 < 8.0.53 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.0.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.0.53security-8 advisory. - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by...

PT-2018-2982 · Apache +7 · Apache Tomcat +7

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 7.0.35 through 7.0.88 Apache Tomcat versions 8.0.0.RC1 through 8.0.52 Apache Tomcat versions 8.5.0 through 8.5.31 Apache Tomcat versions 9.0.0.M1 through 9.0.9 Description: The issue is related to the host name...

CVE-2018-11631

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic...

CVE-2018-11631

Technical details about CVE-2018-11631 are not publicly provided in the supplied documents. No concrete information on affected versions, root cause, or fixes is available here. Monitor for updates from official sources.

CVE-2018-11631: Undefined Security Weakness

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic...

PT-2018-10715

Name of the Vulnerable Software and Affected Versions Rondaful M1 Wristband Smart Band version 1 Description The issue allows remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy BLE traffic. Recommendations For Rondaful M1 Wristband Smart Ban...

Apache Tomcat 'CORS Filter' Setting Security Bypass Vulnerability

Apache Tomcat is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...