37 matches found
EUVD-2013-4710
Malware in sbrugna...
CVE-2013-4863
The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows 1 remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or 2 remote authenticated users to execute arbitrary Lua code via a RunLua action in a request...
CVE-2013-4865
Cross-site request forgery CSRF vulnerability in upgradestep2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs parameter...
CVE-2013-4861
Directory traversal vulnerability in cgi-bin/cmh/getfile.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users to read arbirary files via a .. dot dot in the filename parameter...
CVE-2013-4862
MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to 1 update the firmware via the squashfs parameter to upgradestep2.sh or 2 obtain hashed passwords via the cgi-bin/cmh/backup.sh page...
CVE-2013-4864
MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery SSRF issue...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in upgradestep2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs parameter...
Design/Logic Flaw
MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to 1 update the firmware via the squashfs parameter to upgradestep2.sh or 2 obtain hashed passwords via the cgi-bin/cmh/backup.sh page...
Server side request forgery (ssrf)
MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery SSRF issue...
Design/Logic Flaw
The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows 1 remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or 2 remote authenticated users to execute arbitrary Lua code via a RunLua action in a request...
Directory traversal
Directory traversal vulnerability in cgi-bin/cmh/getfile.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users to read arbirary files via a .. dot dot in the filename parameter...
CVE-2013-4861
Directory traversal vulnerability in cgi-bin/cmh/getfile.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users to read arbirary files via a .. dot dot in the filename parameter...
CVE-2013-4861
MiCasaVerde VeraLite (firmware 1.5.408) is affected by CVE-2013-4861 due to a path traversal flaw in cgi-bin/cmh/get_file.sh that allows remote-authenticated attackers to read arbitrary files by supplying a .. in the filename parameter. The vulnerability enables disclosure of sensitive files such...
CVE-2013-4862
MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to 1 update the firmware via the squashfs parameter to upgradestep2.sh or 2 obtain hashed passwords via the cgi-bin/cmh/backup.sh page...
CVE-2013-4862
Vulnerability CVE-2013-4862 affects MiCasaVerde VeraLite firmware 1.5.408. The issue arises from improper access restrictions that enable remote authenticated users to (1) update the firmware via the squashfs parameter to upgrade_step2.sh and (2) retrieve hashed passwords via the cgi-bin/cmh/back...
CVE-2013-4863
The MiCasaVerde VeraLite smart home controller (firmware 1.5.408 ) is vulnerable to remote code execution in the HomeAutomationGateway service. The flaw allows remote attackers to execute arbitrary Lua code via a RunLua action sent to the upnp/control/hag endpoint on port 49451 . Alternatively, r...
CVE-2013-4863
The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows 1 remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or 2 remote authenticated users to execute arbitrary Lua code via a RunLua action in a request...
CVE-2013-4864
MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery SSRF issue...
CVE-2013-4864
MiCasaVerde VeraLite firmware 1.5.408 is affected by a Server-Side Request Forgery (SSRF) vulnerability exposed via the url parameter to cgi-bin/cmh/proxy.sh. Remote attackers can cause the device to initiate HTTP requests to intranet/internal servers. Public references cite Trustwave SpiderLabs ...
CVE-2013-4865
Cross-site request forgery CSRF vulnerability in upgradestep2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs parameter...