PT-2016-6627

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to obtain access via the web management interface due to a hardcoded password of admin for the admin account...

CVE-2016-5668: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call...

PT-2016-6624

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to bypass authentication by making a direct request to a page other than index.html. Recommendations For Crestron...

PT-2016-6628

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication ...

PT-2016-6625

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to bypass authentication and change settings via a JSON API call. Recommendations For devices with firmware prior to...

PT-2016-6623

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to obtain access by setting the value of objresp.authenabled to 1, due to the device relying on the client to perfor...

PT-2016-6626

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to conduct man-in-the-middle attacks against HTTPS sessions. This is due to the use of a hardcoded X.509 certificate...

Crestron Electronics DM-TXRX-100-STR Security Restriction Bypass Vulnerability

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. A security vulnerability exists in the Crestron Electronics DM-TXRX-100-STR 1.3039.00040. It could allow a remote attacker to bypass authentication by directly requesting a non-index.html page...

CVE-2016-5670: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface...

Crestron Electronics DM-TXRX-100-STR web interface contains multiple vulnerabilities

Overview Crestron Electronics DM-TXRX-100-STR, version 1.2866.00026 and earlier, has a web management interface which contains multiple vulnerabilities, including authentication bypass, failure to restrict access to authorized users, use of hard-coded certificate, default credentials, and...

PT-2016-6817

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.38 Description The issue allows remote attackers to cause a denial of service or possibly have other unspecified impacts. This is due to vectors involving the smart str data type in the php url parse ex function...

Libksba One Error Vulnerability

Libksba is a library that simplifies work tasks for X.509 certificates, CMS data and related objects in the GnuPG project developed by the GNU Project. A difference-one error vulnerability in Libksba's src/dn.c file can be exploited by an attacker to cause OOB read access in ksbadntostr...

ZenPhoto 1.4.11 - Remote File Inclusion

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Zenphoto 1.4.11 Fixed in: 1.4.12 Fixed Version Link: https://github.com/zenphoto/zenphoto/archive/ zenphoto-1.4.12.zip Vendor Website: http://www.zenphoto.org/ Vulnerability Type: RFI Remote Exploitable: Yes Reported to...

PT-2023-26337

Name of the Vulnerable Software and Affected Versions w3m affected versions not specified Description An out-of-bounds read flaw was found in the growbuf to Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file. Recommendations At the...

Updated python-curl packages fix security vulnerability

A use-after-free vulnerability was found in Curl object's HTTPPOST setopt when a Unicode value is passed as a value with a FORMBUFFERPTR. The str object created from the passed in unicode object would have its buffer used but the unicode object would be stored instead of the str object rhbz127748...

PT-2014-8816

Name of the Vulnerable Software and Affected Versions Libksba versions prior to 1.3.2 Description The issue allows remote attackers to cause a denial of service crash via a crafted OID in a S/MIME message or ECC based OpenPGP data, which triggers a buffer overflow. This occurs due to an integer...

PT-2014-5605

Name of the Vulnerable Software and Affected Versions Ruby versions 1.9.3, 2.0.0, and 2.1 Description The issue allows context-dependent attackers to cause a denial of service, resulting in a segmentation fault and crash, by utilizing a long string in the str buf cat function. Recommendations For...

cups security and bug fix update

1:1.4.2-67 - Revert change to whitelist /rss/ resources, as this was not used upstream. 1:1.4.2-66 - More STR 4461 fixes from upstream: make rss feeds world-readable, but cachedir private. - Fix icon display in web interface during server restart STR 4475. 1:1.4.2-65 - Fixes for upstream patch fo...

FFmpeg libavformat 'psxstr.c' STR Data Heap Based Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30154/info The 'libavformat' library from FFmpeg is prone to a remote heap-based buffer-overflow vulnerability because of insufficient boundary checks when parsing STR data. Remote attackers can exploit this issue by...

Oracle Linux 6 : cups (ELSA-2010-0866)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0866 advisory. 1:1.4.2-35:.1 - Applied patch to fix cupsd memory corruption vulnerability CVE-2010-2941, STR 3648, bug 624438. Tenable has extracted the preceding description...