VulnCheck KEV: CVE-2017-20210

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research...

PTV Sports Cricket Station - Dynamic Code Loading, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application PTV Sports Cricket Station published at the 'play' market has multiple vulnerabilities...

Huawei P9 Input Checksum Vulnerability

Huawei P9 is a smartphone from Huawei. The Huawei P9 suffers from an input validation vulnerability, which can be exploited by an attacker to send a forged air-port message to the affected product via a spoofed base station. Due to insufficient checksums on certain fields in the message, an...

Synology Photo Station Elevation of Privilege Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. An elevation of privilege vulnerability exists in Synology Photo Station. A local attacker can exploit this vulnerability to gain privileges...

Synology Photo Station Security Bypass Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A security bypass vulnerability exists in Synology Photo Station versions prior to 6.3-2958. The vulnerability can be exploited by a remote attacker to execute arbitrary commands by sending an...

CVE-2016-10323

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

Design/Logic Flaw

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

Command injection

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

CVE-2016-10323

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

CVE-2016-10323

Synology Photo Station prior to version 6.3-2958 contains an elevation of privilege due to a setuid execution flaw in the command "synophoto_dsm_user --copy-no-ea", allowing local users to gain privileges. This is documented across multiple sources (CVE-2016-10323, including Red Hat and CVE recor...

CVE-2016-10323

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophotodsmuser --copy-no-ea" command...

CVE-2016-10322

Synology Photo Station (pre-6.3-2958) is affected by CVE-2016-10322. Remote authenticated guest users can inject shell metacharacters in the X-Forwarded-For header to photo/login.php and execute arbitrary commands. Impact is described as remote code execution with the attacker in a low-privilege ...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

ICSMA-17-082-02_B. Braun Medical SpaceCom Open Redirect Vulnerability

OVERVIEW This advisory was originally posted to the NCCIC Portal on March 23, 2017, and is being released to the ICS-CERT web site. Marc Ruef and Rocco Gagliardi of scip AG have identified an open redirect vulnerability in B. Braun Medical’s SpaceCom module, which is integrated into the...

CVE-2016-2274

The CVE-2016-2274 issue affects the Adcon Telemetry A850 Telemetry Gateway Base Station web interface. The vulnerability is a Cross-Site Scripting (CWE-79) due to improper neutralization of user-controlled input before output, enabling injection of arbitrary JavaScript. Impact is described as pot...

About the security content of AirPort Base Station Firmware Update 7.6.7 and 7.7.7 - Apple Support

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website. For information about...

CVE-2016-10115

NETGEAR Arlo base stations with firmware 1.7.56178 and earlier, Arlo Q devices with firmware 1.8.05551 and earlier, and Arlo Q Plus devices with firmware 1.8.16094 and earlier have a default password of 12345678, which makes it easier for remote attackers to obtain access after a factory reset or...

Adcon Telemetry A850 Telemetry Gateway Base Station Cross-Site Scripting Vulnerability

The Adcon Telemetry A850 Telemetry Gateway Base Station is a wireless telemetry system from Adcon Telemetry of Austria. A cross-site scripting vulnerability exists in the Adcon Telemetry A850 Telemetry Gateway Base Station. An attacker can exploit this vulnerability to inject arbitrary JavaScript...