CVE-2019-18980

The CVE describes an authentication-less control API on Signify Philips Taolight Smart Wi‑Fi Wiz Connected LED Bulb 9290022656. A remote attacker with network access can operate the bulb: turn it on/off, adjust color, or change brightness, due to no authentication or encryption on the control API...

CVE-2019-18980

On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...

CVE-2019-16110

The network protocol of Blade Shadow though 2.13.3 allows remote attackers to take control of a Shadow instance and execute arbitrary code by only knowing the victim's IP address, because packet data can be injected into the unencrypted UDP packet stream...

WordPress codepress-admin-columns injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. codepress-admin-columns is a content management plugin used in it. An injection vulnerability exists in WordPress...

The vulnerability of the EAP Controller remote management utility lies in the lack of authentication for a critical function, allowing a malicious actor to control the target server and execute arbitrary Java or bytecode.

The vulnerability of the EAP Controller remote management utility lies in the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to remotely control the target server and execute arbitrary Java or bytecode...

CVE-2019-17661

A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...

CVE-2019-17661

A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...

Input validation

A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...

CVE-2019-17661

A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...

CVE-2019-17661

A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...

mc2SLut7w3AZ5Rq

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

SolarWinds Dameware Mini Remote Control Unauthenticated RCE

The SolarWinds Dameware Mini Remote Control Client Agent running on the remote host is affected by a remote code execution vulnerability due to improper validation of user-supplied data. An unauthenticated, remote attacker can exploit this, via a series of requests, to execute arbitrary code. C...

OM0wgey9EqE2QBT

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

D-Link DIR Devices Information Disclosure Vulnerability (Oct 2019)

Multiple D-Link DIR devices are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link DIR-817LW and D-Link DIR-868L License Issue Vulnerability

The D-Link DIR-817LW and the D-Link DIR-868L are both wireless routers from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-868L version B1-2.03 and the DIR-817LW version A1-1.04, which stems from the fact that some web interfaces do not require authentication. The...

Authentication flaw

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password and other information via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZEDGROUP=1%0a to getcfg.php...

CVE-2019-17506

CVE-2019-17506 affects D-Link DIR-868L (B1-2.03) and DIR-817LW (A1-1.04). The issue is information disclosure due to web interfaces that do not require authentication, allowing an attacker to obtain router credentials and other data via a DEVICE.ACCOUNT value for SERVICES combined with AUTHORIZED...

CVE-2019-17506

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password and other information via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZEDGROUP=1%0a to getcfg.php...

For Cybersecurity and Domestic Violence Awareness months, we pledge to fight stalkerware

Starting today, two hallmark holidays are upon us. No, it’s not Halloween and Thanksgiving. It’s both Cybersecurity Awareness Month and Domestic Violence Awareness Month. It’s no coincidence these two awareness campaigns overlap. What were once seen as separate realities—the physical and the...

SIEMENS S7-200 SIMATIC PLC suffers from a remote control vulnerability (CNVD-2019-37705)

S7-200 SMART is a small PLC developed by Siemens with a friendly interface and more user-friendly software operation. A remote control vulnerability exists in SIEMENS S7-200 SIMATIC PLC. An attacker can exploit the vulnerability to construct special application layer data messages that result in ...