(Pwn2Own) NETGEAR R6700v3 Missing Authentication for Critical Function Arbitrary File Upload Vulnerability

This vulnerability allows network-adjacent attackers to upload arbitrary files on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Circle Parental Control feature, which listens on TCP ports 4444 a...

Canopy Parental Control App Wide Open to Unpatched XSS Bugs

Canopy, a parental control app that offers a range of features meant to protect kids online via content inspection, is vulnerable to a variety of cross-site scripting XSS attacks, according to researchers. The attacks could range from a sneaky kid disabling the monitoring to a much more serious...

High-Severity RCE Flaw Disclosed in Several Netgear Router Models

Networking equipment company Netgear has released patches to remediate a high-severity remote code execution vulnerability affecting multiple routers that could be exploited by remote attackers to take control of an affected system. Traced as CVE-2021-40847 CVSS score: 8.1, the security weakness...

CVE-2021-40847

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

CVE-2021-40847

CVE-2021-40847 affects Netgear routers through the Circle parental controls update mechanism. The Circle update daemon (circled), enabled by default, fetches unsigned updates over HTTP and, under a MitM, can be tricked into delivering a crafted compressed database that overwrites executables with...

NETGEAR 代码注入漏洞

Netgear NETGEAR is a router from Netgear, an American company. NETGEAR routers have a security vulnerability that could allow remote attackers to remotely execute code as root via a MitM attack during updates to the Circle parental control service...

The vulnerability of the function in bl_categires_help.php, a parental control function for Internet CTparental, allows a intruder to inject any code they desire.

The vulnerability of the CTparental parental control function in blcategireshelp.php exists due to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a hacker to inject arbitrary code...

CTparental 跨站脚本漏洞

CTparental is a tool for filtering web content. Inappropriate content can be filtered using blacklists or whitelists, time spent browsing the Internet can be controlled and time spent active on control devices. CTparental suffers from a cross-site scripting vulnerability that originates in...

Google: Efforts Against Bad Android Apps on Play Store Are Working

Some of the efforts Google has made over the past few years to bolster the security of Android app users as well as the mobile apps available on its Google Play store are starting to work, according to the tech giant. The company, which historically has struggled mightily to keep bad apps and...

CVE-2020-7997

ASUS WRT-AC66U 3 RT 3.0.0.4.37267 devices allow XSS via the Client Name field to the Parental Control feature...

CVE-2020-7997

ASUS WRT-AC66U 3 RT 3.0.0.4.37267 devices allow XSS via the Client Name field to the Parental Control feature...

Design/Logic Flaw

ASUS WRT-AC66U 3 RT 3.0.0.4.37267 devices allow XSS via the Client Name field to the Parental Control feature...

CVE-2020-7997

ASUS WRT-AC66U 3 RT 3.0.0.4.37267 devices allow XSS via the Client Name field to the Parental Control feature...

CVE-2020-7997

ASUS WRT-AC66U devices (3 RT 3.0.0.4.372_67) are vulnerable to cross-site scripting via the Client Name field in the Parental Control feature. The CNVD-2020-04914 entry describes a lack of proper validation of client-side data by the WEB application, enabling XSS. Exploitation details are not pro...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the D-Link DSL-6740U gateway Rev. H1 allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to 1 Custom Services in Port Forwarding, 2...

CVE-2013-6811

Multiple cross-site request forgery CSRF vulnerabilities in the D-Link DSL-6740U gateway Rev. H1 allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to 1 Custom Services in Port Forwarding, 2...

CVE-2019-1549

OpenSSL 1.1.1 introduced a rewritten random number generator RNG. This was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A...

This is what our summer’s like

For the second summer straight, we cover the children's interests during the period when they have enough leisure to give themselves full time to their hobbies. Modern children are active users of the internet, so most of their interests find reflection in their online activities, which are the...

What kids get up to online

Today's children navigate the Internet better than adults. They are not afraid to try out new technology, and are quick to grasp new trends and sometimes invent their own. New social networks, mobile games, music, and gadgets are all part and parcel of their daily lives. But just because they fee...

Apple Defends Parental Control App Removal Amid Backlash

Apple is defending its decision to take down several highly popular parental control apps amidst a firestorm of backlash, saying it did so for “privacy and security” reasons. Apple came under scrutiny this weekend after a New York Times article alleged that the phone giant had unfairly removed or...