Design/Logic Flaw

A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information...

Mercedes-Benz HERMES misconfiguration vulnerability (CNVD-2021-17721)

Mercedes-Benz HERMES is a telematics control unit equipped in Mercedes-Benz connected vehicles. A misconfiguration vulnerability exists in the debug interface in Mercedes-Benz HERMES 1. An attacker with direct physical access to the device hardware could exploit the vulnerability to obtain cellul...

Mercedes-Benz HERMES misconfiguration vulnerability (CNVD-2021-17724)

Mercedes-Benz HERMES is a telematics control unit equipped in Mercedes-Benz connected vehicles. A misconfiguration vulnerability exists in the debug interface in Mercedes-Benz HERMES 1.5. An attacker with direct physical access to the device hardware could exploit the vulnerability to obtain...

Mercedes-Benz HERMES Misconfiguration Vulnerability

Mercedes-Benz HERMES is a telematics control unit equipped in Mercedes-Benz connected vehicles. A misconfiguration vulnerability exists in the debug interface in Mercedes-Benz HERMES 2.1. An attacker with direct physical access to the device hardware could exploit the vulnerability to obtain...

CVE-2019-19561

A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information...

CVE-2019-19561

CVE-2019-19561 affects Mercedes‑Benz HERMES 1.5 Telematics Control Unit; a misconfiguration in the Hermes debug interface can, with direct physical access, disclose cellular modem information. The available documents describe the vulnerability and affected component but do not provide a remediati...

CVE-2019-19557

CVE-2019-19557 describes a misconfiguration in the debug interface of the Mercedes‑Benz HERMES 1 Telematics Control Unit. An attacker with direct physical access to the device could extract cellular‑modem information due to this misconfiguration. Documented in multiple sources (NVD entry, Red Hat...

CVE-2019-19557

A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information...

CVE-2019-19563

CVE-2019-19563 concerns a misconfiguration in the debug interface of Mercedes-Benz HERMES 2.1. The issue, exploitable by an attacker with direct physical access to the device hardware, could expose cellular modem information. The description across sources confirms the vulnerability is tied to a ...

CVE-2019-19563

A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular modem information...

HackerOne: Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos

@nagli found a misconfiguration in an interstitial page that could lead to a link to be indexed by a 3rd party. This could have exposed links to proof of concepts that HackerOne users had posted on hackerone.com. This affected a specific set of customers, which HackerOne worked together with to...

CVE-2020-5426

Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give ...

Amazon Linux 2 : ibus (ALAS-2020-1555)

The version of ibus installed on the remote host is prior to 1.5.17-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1555 advisory. A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due...

Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data

Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® version 8 framework. See the ATT&CK for Enterprise version 8 for all referenced threat actor techniques. This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure...

TikTok: RCE on TikTok Ads Portal

The video upload endpoint on the TikTok Ads portal was potentially susceptible to remote code execution RCE due to a ffmpeg misconfiguration. We thank @ bubbounty for reporting this to our team and confirming the resolution. During my research on the TikTok Ads portal I found a RCE thought the...

CVE-2020-3690

u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Insecure Defaults

Overview socket.io is a node.js realtime framework server. Affected versions of this package are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Remediation Upgrade socket.io to version 2.4.0 or higher. References - GitHub Issue - HackerOne...

Synology SRM QuickConnect iptables network misconfiguration vulnerability

Summary An exploitable network misconfiguration vulnerability exists in the QuickConnect iptables functionality of Synology SRM 1.2.3 RT2600ac 8017-5. Packets originating from the QuickConnect VPN interface are not filtered, resulting in unrestricted communication with any network service running...

Synology QuickConnect servers network misconfiguration vulnerability

Summary An exploitable network misconfiguration vulnerability exists in the VPN servers of Synology QuickConnect. The server does not enforce proper subnetting, allowing an attacker to reach any device connected to the VPN. To abuse this vulnerability, the attacker needs to change their subnet...

Eagle - Yet Another Vulnerability Scanner

Project Eagle is a plugin based vulnerabilities scanner with threading support used for detection of low-hanging bugs on mass scale .---. .----------- / \ / ------ / / \ / ----- ////// ' / --- Multipurpose vulnerability scanner //// / // : : --- v1.0b / / / / '-- 2019-2020 //..\ ====UU====UU====...