CVE-2017-18187

In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the sslparseclientpskidentity function in library/sslsrv.c...

gnutls: Use-of-uninitialized-value in __gmpz_limbs_finish

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=4887173172035584 Project: gnutls Fuzzer: libFuzzergnutlspskclientfuzzer Fuzz target binary: gnutlspskclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

Design/Logic Flaw

An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET parameter to download files from the device as the root user. The attacker can download any file from the device's filesystem. This can be...

CVE-2016-5056

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK...

CVE-2016-5051

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application...

Design/Logic Flaw

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application...

Buffer overflow

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK...

CVE-2016-5056

CVE-2016-5056 affects OSRAM SYLVANIA Osram Lightify Pro devices with a PSK limited to 8 hex digits (firmware prior to 2016-07-26). Connected data also references OSRAM Lightify Home vulnerabilities (e.g., MITM risk due to lack of SSL pinning) in related ENISA/CNVD entries, but the Lightify Pro PS...

CVE-2016-5051

OSRAM SYLVANIA Osram Lightify Home vulnerability (pre-2016-07-26). The issue stems from the product not using SSL pinning, enabling a Man-in-the-Middle to intercept TLS-encrypted traffic. Affected versions are 2016-07-26 and earlier. The CNVD entry states this vulnerability allows an attacker to ...

CVE-2016-5051

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application...

CVE-2016-5056

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK...

CVE-2015-5729

The Soft Access Point AP feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, which makes it easier for remote attackers to obtain sensitive information or bypass authentication via a brute-force attack...

CVE-2015-5729

The CVE-2015-5729 entry describes a vulnerability in Samsung Smart TVs (models X10P, X12, X14H, X14J, NT14U) and Xpress M288OFW printers where the Soft Access Point WPA2-PSK keys are weak and can be brute-forced, enabling an attacker to obtain sensitive information or bypass authentication over a...

How To Stop Larry From Hacking Your WiFi in 2017

It’s 2017, and we’re not any further along with Wi-Fi security than we were 10 years ago. There are Intrusion Detection Systems and 2nd generation antivirus apps to protect us from some vulnerabilities but the simple fact that some people and businesses still don’t set their network up well in th...

[ASA-201610-7] wpa_supplicant: multiple issues

Arch Linux Security Advisory ASA-201610-7 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : wpasupplicant Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package...

BT Wifi Extenders 300 / 600 / 1200 Cross Site Scripting

BT Wifi Extenders - 300, 600 and 1200 models - Cross Site Scripting leading to disclosure of PSK. A firmware update is required to resolve this issue. The essential problem is that if you hit the following URL on your wifi extender, it will pop up a whole load of private data, including your PSK...

Unpatched Smart Lighting Flaws Pose IoT Risk to Businesses

A host of web-based vulnerabilities in Osram Lightify smart lighting products remain unpatched, despite private notification to the vendor in late May and CVEs assigned to the issues in June by CERT/CC. Researchers at Rapid7 today publicly disclosed some of the details on each of the nine...

Magnet Networks Tesley CPVA 642 Router - Weak WPA-PSK Passphrase Algorithm

Magnet Networks Tesley CPVA 642 Router - Weak WPA-PSK Passphrase Algorithm Exploit Title: Magnet Networks – Weak WPA-PSK passphrases used in Tesley CPVA 642 Router Google Dork: Date: 01/06/2016 Author: Matt O'Connor Advisory Link: https://www.rgb.ie/magnet-broadband-weak-wpa-psk-algorithm.pdf...

Magnet Networks Tesley CPVA 642 Router - Weak WPA-PSK Passphrase Algorithm

Exploit for hardware platform in category dos / poc Exploit Title: Magnet Networks – Weak WPA-PSK passphrases used in Tesley CPVA 642 Router Google Dork: Date: 01/06/2016 Author: Matt O'Connor Advisory Link: https://www.rgb.ie/magnet-broadband-weak-wpa-psk-algorithm.pdf Version: Category: Remote...

FreeBSD : hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written (967b852b-1e28-11e6-8dd3-002590263bf5)

Jouni Malinen reports : psk configuration parameter update allowing arbitrary data to be written 2016-1 - CVE-2016-4476/CVE-2016-4477. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...