Inim Electronics Smartliving SmartLAN 6.x - Hard-coded Credentials Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Inim Electronics Smartliving SmartLAN 6.x - Hard-coded Credentials Exploit Author: LiquidWorm Product web page: https://www.inim.biz Link:...

Smart Trim - Moderately critical - Cross site scripting - SA-CONTRIB-2019-092

The Smart Trim module allows site builders additional control with text summary fields. The module doesn't sufficiently filter text when certain options are selected. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content on the site when...

Xmas Light Security Improves… a bit

We've looked at smart Xmas lights before; whilst they were vulnerable, there was no consequence to the hack other than making them flash in a different order! In 2018 we looked at the all-new Twinkly smart festive lights. We found a number of security issues, reported them to the vendor and to a...

Please don’t buy this: smart doorbells

Though Black Friday and Cyber Monday are over, the two shopping holidays were just precursors to the larger Christmas season—a time of year when online packages pile high on doorsteps and front porches around the world. According to some companies, it's only logical to want to protect these...

CVE-2019-11216

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed...

Design/Logic Flaw

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed...

CVE-2019-11216

CVE-2019-11216 affects BMC Smart Reporting 7.3 (20180418). The issue is an XML External Entity (XXE) vulnerability in the import functionality, enabling an authenticated attacker to import a malicious XML file to perform XXE attacks, potentially downloading local server files or triggering DoS vi...

CVE-2019-11216

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed...

BMC Smart Reporting 7.3 20180418 XML Injection

4 43 7.3 20180418 2019-01-18 10:14 UTC +0000 66717 sour...

BMC Smart Reporting XML External Entity Injection Vulnerability

BMC Smart Reporting is a smart reporting system. BMC Smart Reporting suffers from an XML External Entity Injection vulnerability that allows an authenticated attacker with administrator privileges to import a malicious XML file and perform an XXE attack to download a local file from a server, or...

Smart TVs: The Cyberthreat Lurking in Your Living Room, Feds Warn

Black Friday and Cyber Monday sales of smart TVs are likely prodigious this Thanksgiving weekend – but consumers need to be aware of the hole they can punch in home cyber-defenses. That’s the word from the FBI, which warned that smart TVs, which hook up to the internet to allow users to access ap...

BMC Remedy Smart Reporting CVE-2019-11216 XML External Entity Injection Vulnerability

Description BMC Remedy Smart Reporting is prone to an XML External Entity injection vulnerability. Attackers can exploit this issue to obtain potentially sensitive information or cause a denial-of-service condition. This may lead to further attacks. BMC Remedy Smart Reporting versions 9.1.03.001,...

Carlo Gavazzi SmartHouse 6.5.33 XSS / Cross Site Request Forgery

Carlo Gavazzi SmartHouse Webapp 6.5.33 CSRF/XSS Vulnerabilities Vendor: Carlo Gavazzi Automation S.p.A Product web page: http://www.gavazzi-automation.com | http://www.smarthouse.nu Affected version: Web-app: 6.5.33.17072501 Web-app: 6.5.32.17062101 Web-app: 6.2.3.16102701 Web-app: 5.5.3.16042110...

CVE-2019-5271

There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the cloud through Wi-Fi, the speaker incorrectly processes some data. Attackers can exploit this vulnerability to read and modify specific configurations of speakers through a series of...

Information disclosure

There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the cloud through Wi-Fi, the speaker incorrectly processes some data. Attackers can exploit this vulnerability to read and modify specific configurations of speakers through a series of...

CVE-2019-5271

CVE-2019-5271 affects Huawei Myna smart speaker. The vulnerability is an information leak arising when the device is paired with the cloud over Wi‑Fi, where data is mishandled during processing, allowing an attacker to read and modify specific configurations via a sequence of operations. Root cau...

CVE-2019-5271

There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the cloud through Wi-Fi, the speaker incorrectly processes some data. Attackers can exploit this vulnerability to read and modify specific configurations of speakers through a series of...

Logic Flaw Vulnerability in Intelligent Gateway of Beijing BiNian Technology Co.

Smart Gateway is a multi-service converged gateway that integrates the features of wireless controller AC, router and firewall independently developed by Beijing Beyond Technology Co. A logic flaw vulnerability exists in the Intelligent Gateway of Beijing BiNian Technology Co. An attacker can for...

Huawei Myna Information Disclosure Vulnerability

Huawei Myna is a smart speaker from Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei Myna, which stems from the speaker's mishandling of transmitted data when the smart speaker and the cloud are paired over Wi-Fi. An attacker could use the vulnerability to...

Cisco IOS Software Smart Install DoS (cisco-sa-20180328-smi)

According to its self-reported version, Cisco IOS is affected by a denial of service DoS vulnerability in the Smart Install feature due to improper validation of packet data. An unauthenticated, remote attacker can exploit this by sending a crafted packet to an affected device on TCP port 4786 in...