Default credentials

EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application...

Code injection

EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintext. By visiting the kiosk and viewing the Visitor table of the database, an attacker could exploit this vulnerability to view stored social security numbers...

HID Global EasyLobby Solo Access Control Error Vulnerability (CNVD-2019-12473)

HID Global EasyLobby Solo is a suite of Secure Visitor Management SVM software from HID Global, USA. A security vulnerability exists in HID Global EasyLobby Solo version 11.0.4563. A local attacker can exploit the vulnerability by accessing the self-service server and task manager to terminate...

HID Global EasyLobby Solo Access Control Error Vulnerability

HID Global EasyLobby Solo is a suite of Secure Visitor Management SVM software from HID Global, USA. A security vulnerability exists in HID Global EasyLobby Solo version 11.0.4563. A local attacker can exploit the vulnerability to perform unauthorized actions on a computer...

EasyLobby Solo Information Disclosure Vulnerability

HID Global EasyLobby Solo is a suite of Secure Visitor Management SVM software from HID Global, USA. An information disclosure vulnerability exists in HID Global EasyLobby Solo version 11.0.4563, which stems from the program storing Social Security numbers in plaintext. A local attacker could...

EasyLobby Solo Default Management Credentials Vulnerability

HID Global EasyLobby Solo is a suite of Secure Visitor Management SVM software from HID Global, USA. A security vulnerability exists in HID Global EasyLobby Solo version 11.0.4563, which stems from the program's use of default administrative credentials. A local attacker could exploit the...

CVE-2018-17492

EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application...

CVE-2018-17491

EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing "esc" to exit the program, an attacker could exploit this vulnerability to perform unauthorized actions on the computer...

CVE-2018-17489

EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintext. By visiting the kiosk and viewing the Visitor table of the database, an attacker could exploit this vulnerability to view stored social security numbers...

CVE-2018-17490

EasyLobby Solo (visitor management system) contains a local denial-of-service vulnerability in the kiosk task manager. A local attacker can kill or spawn processes by interacting with the kiosk task manager, per CVE-2018-17490. Exploitation details are described in NVD and ThreatPost summaries; T...

CVE-2018-17491

CVE-2018-17491 affects HID Global EasyLobby Solo. It describes a local privilege-escalation where a user at the kiosk can exit the program (esc) and perform unauthorized actions on the host. The NVD metrics list CVSSv3.0: LOCAL attack vector, LOW attack complexity, NONE privileges required, UI NO...

CVE-2018-17490

EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local attacker could exploit this vulnerability to kill the process or launch new processes at will...

CVE-2018-17489

CVE-2018-17489 affects HID Global EasyLobby Solo. Affected version: EasyLobby Solo (observed in CNVD entry as EasyLobby Solo Information Disclosure) with plaintext storage of Social Security numbers in the Visitor database table, exploitable by a local attacker visiting the kiosk/self-service ser...

CVE-2018-17492

CVE-2018-17492 affects EasyLobby Solo (HID Global EasyLobby Solo) where default administrative credentials are present. The root cause is the use of default credentials, enabling a local attacker to gain full access to the application. The vulnerability is documented with a high impact in CVSS v3...

Design/Logic Flaw

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator...

CVE-2018-16805

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator...

CVE-2018-16805

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator...

CVE-2018-16805

In CVE-2018-16805, the affected software is b3log Solo 2.9.3. The vulnerability is a cross-site scripting (XSS) flaw on the Input page under Publish Articles, where an ID named linkAddress stored in the link JSON field can be exploited to inject arbitrary Web scripts or HTML via a crafted site na...

CVE-2018-16805

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator...

HID discoveryd command_blink_on Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HID discoveryd commandblinkon Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated remote command execution...