CVE-2018-19392

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...

Cross site scripting

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field...

Cross site scripting

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field e.g., Satellite name, and then restoring the...

Design/Logic Flaw

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...

CVE-2018-19391

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field...

CVE-2018-19393

Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could b...

CVE-2018-19394

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field e.g., Satellite name, and then restoring the...

CVE-2018-19393

Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could b...

CVE-2018-19392

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...

CVE-2018-19391

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field...

CVE-2018-19392

Cobham Satcom Sailor 250/500 devices before firmware 1.25 have an unauthenticated password-reset vulnerability that lets a remote attacker change any user password (including admin) using the username and the attack vector /index.lua?pageID=Administration with fields usernameAdmChange, passwordAd...

CVE-2018-19391

The CVE-2018-19391 entry concerns Cobham Satcom Sailor 250 and Sailor 500 devices with persistent cross-site scripting (XSS) in firmware before 1.25. An unauthenticated attacker can exploit this via the /index.lua?pageID=Phone%20book name field to inject JavaScript. Connected CNVD/NVD records con...

CVE-2018-19393

The CVE-2018-19393 entry refers to Cobham Satcom Sailor 800 and 900 devices with an arbitrary write vulnerability in the system configuration file. The issue is exploitable via multiple attack vectors depending on device configuration and can lead to a Denial of Service requiring a factory reset ...

CVE-2018-19394

CVE-2018-19394 concerns Cobham Satcom Sailor 800 and Sailor 900 devices, where a persistent cross-site scripting (XSS) vulnerability exists. The affected component is the device web interface/configuration handling, with the root cause described as an XSS payload that can be introduced by modifyi...

CVE-2018-19394

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field e.g., Satellite name, and then restoring the...

Hacking, tracking, stealing and sinking ships

At Infosecurity Europe this year, we demonstrated multiple methods to interrupt the shipping industry, several of which haven’t been demonstrated in public before, to our knowledge. Some of these issues were simply through poor security hygiene on board, but others were linked to the protocols us...

Two Critical Vulnerabilities Found In Inmarsat’s SATCOM Systems

UPDATE Researchers are warning of two critical vulnerabilities in global satellite telecommunications company Inmarsat’s SATCOM systems. The vulnerabilities impact thousands of customers running the newest version of its AmosConnect platform, typically found on maritime sea vessels, according to...

In-Flight Entertainment System Flaws Put Passenger Data at Risk

A simple tap on an in-flight entertainment system touchscreen kicked off an intellectual exercise that resulted in the discovery of a number of firmware vulnerabilities in embedded systems used by at least 13 airlines. The vulnerabilities in the Panasonic Avionics IFE firmware could allow a local...

Eshopbuilde CMS SQL Injection

================= IUT-CERT ================= Title: Eshopbuilde CMS SQL Injection Vulnerability Vendor: www.eshopbuilder.ir Dork: Design by Satcom Co Type: Input.Validation.Vulnerability SQL Injection Fix: N/A ================== nsec.ir ================= Description: ------------------ Eshopbuild...

satcom-xss.txt

--------------------------------------------------------- Portal Name: SatCom Cms Vendor : http://satcom.ir Vulnerable File : indexsearch.aspx Author : PouyaServer , [email protected] Vulnerability : XSS Cross site scripting ---------------------------------------------------------...