CVE-2020-10273

The CVE-2020-10273 entry concerns MiR robot controllers (MiR MiR100, MiR200, MiR250, MiR500, MiR1000, and MiR Fleet software older than 2.10.2.1) where sensitive intellectual property artifacts are stored without encryption or protection. The root cause is missing encryption of sensitive data on ...

CVE-2020-10270

CVE-2020-10270 affects MiR robotic fleet (MiR100/MiR200, potentially others) where the Control Dashboard is reachable on a hardcoded IP via wired/wireless interfaces. The flaw enables control of the robot through default, widely known credentials, as documented in past guides, and may be extended...

CVE-2020-10271 RVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired ones

MiR100, MiR200 and other MiR robots use the Robot Operating System ROS default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS and/or applying custom patches as...

CVE-2020-10271

MiR robots (MiR100, MiR200, MiR250, MiR500, MiR1000, and MiR Fleet prior to versions stated in advisories) expose the ROS computation graph over internal networks due to default ROS packages and authentication gaps. CVE-2020-10271 is described as the Exposure of Resource to Wrong Sphere: the comp...

CVE-2020-10274 RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)

The access tokens for the REST API are directly derived sha256 and base64 encoding from the publicly available default credentials from the Control Dashboard refer to CVE-2020-10270 for related flaws. This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks...

CVE-2020-10272 RVD#2554: MiR ROS computational graph presents no authentication mechanisms

MiR100, MiR200 and other MiR robots use the Robot Operating System ROS default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with...

PT-2020-12018

Name of the Vulnerable Software and Affected Versions MiR100 affected versions not specified MiR200 affected versions not specified MiR250 affected versions not specified MiR500 affected versions not specified MiR1000 affected versions not specified Description A wireless interface in certain MiR...

PT-2020-12021

MiR100, MiR200 and other MiR robots use the Robot Operating System ROS default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with...

PT-2020-12022

Name of the Vulnerable Software and Affected Versions MiR controllers versions 2.8.1.1 and earlier Description The issue concerns the lack of encryption or protection for intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot...

PT-2020-12020

Name of the Vulnerable Software and Affected Versions MiR100, MiR200 and other MiR robots affected versions not specified Description The issue is related to the Robot Operating System ROS default packages exposing the computational graph to all network interfaces. This exposure is due to a bad...

PT-2020-12028

Name of the Vulnerable Software and Affected Versions MiR robot controllers central computation unit version Ubuntu 16.04.2 Description The MiR robot controllers' central computation unit uses Ubuntu 16.04.2, an operating system initially designed for desktop use, which presents insecure defaults...

CVE-2020-10279: Incorrect Default Permissions

MiR robot controllers central computation unit makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creatio...

CVE-2020-10273: Missing Encryption of Sensitive Data

MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot network while in combination with other flaws to retrieve and easily...

mir-antey.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1067027 Security Researcher geeknik Helped patch 8722 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting mir-antey.ru website and i...

Spidermonkey - IonMonkey Leaks JS_OPTIMIZED_OUT Magic Value to Script

Spidermonkey - IonMonkey Leaks JSOPTIMIZEDOUT Magic Value to Script IonMonkey can, during a bailout, leak an internal JSOPTIMIZEDOUT magic value to the running script. This magic value can then be used to achieve memory corruption. Prerequisites Magic Values Spidermonkey represents JavaScript...

mir-fotooboev.ru XSS vulnerability

Open Bug Bounty ID: OBB-714991 Description| Value ---|--- Affected Website:| mir-fotooboev.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Serial Swatter and Stalker Mir Islam Arrested for Allegedly Dumping Body in River

A 22-year-old man convicted of cyberstalking and carrying out numerous bomb threats and swatting attacks -- including a 2013 swatting incident at my home -- was arrested Sunday morning in the Philippines after allegedly helping his best friend dump the body of a housemate into a local river...

Mail.ru: Uninitilized server memory disclosure via ImageMagick

It was possible to disclosure the part of server memory from uncontrolled location on the server belonging to "Moi Mir" my.mail.ru project via uploaded GIF image header manipulation. my.mail.ru is not currently in the Bug Bounty scope, reward was paid as a bonus due to potential severity...

mir-es.com XSS vulnerability

Open Bug Bounty ID: OBB-437702 Description| Value ---|--- Affected Website:| mir-es.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Mail.ru: Blind XXE on my.mail.ru

Blind XXE in my.mail.ru Moi Mir avatar upload feature. Moi Mir is not covered by regular Bug Bounty program, a bounty was awarded as a bones due to high potential impact. Blind OOB XXE issue was found in upload avatar feature...