CVE-2018-16287: Unrestricted Upload of File with Dangerous Type

LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs...

CVE-2018-16706: Direct Request

LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsrserver/device/reboot on port 9080...

CVE-2018-16286: Improper Authentication

LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...

PT-2018-13464

Name of the Vulnerable Software and Affected Versions LG SuperSign CMS affected versions not specified Description The issue allows authentication bypass. This is possible because the CAPTCHA requirement can be skipped by sending a captcha:pass cookie. Additionally, the PIN is limited to four...