CVE-2018-5553: Improper Neutralization of Special Elements used in an OS Command

The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access...

PT-2018-17046

Name of the Vulnerable Software and Affected Versions Crestron Console service versions 1.3384.00049.001 and lower Description The issue concerns command injection that can be used to gain root-level access. This affects devices with default configuration, specifically DGE-100, DM-DGE-200-C, and...

PT-2018-1616

Name of the Vulnerable Software and Affected Versions Android versions 7.0 through 9.0 Description The issue is related to a missing bounds check in the rfc process mx message function of rfc ts frames.cc, which could lead to a remote information disclosure. No additional execution privileges are...

CalAmp lenderoutlook on colt.calamp-ts.com incorrect privilege assignment vulnerability

Calamp is a pioneer in M2M telematics, managing over 1.5M IoT devices. An incorrect privilege assignment vulnerability exists in CalAmp lenderoutlook on colt.calamp-ts.com. An attacker could exploit the vulnerability to obtain sensitive data...

openSUSE Security Update : translate-toolkit (openSUSE-2018-130)

This update for translate-toolkit to 2.2.4 fixes several issues. This security issue was fixed : - Prevent inclusion of external ressources XXE boo1073535 These non-security issues were fixed : - Added support for nested and WebExtension JSON dialects. - po2txt no longer converts non-translatable...

ts-wine.com XSS vulnerability

Open Bug Bounty ID: OBB-494355 Description| Value ---|--- Affected Website:| ts-wine.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

gereltyortonts.blogmn.net XSS vulnerability

Open Bug Bounty ID: OBB-455872 Description| Value ---|--- Affected Website:| gereltyortonts.blogmn.net Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventi...

QNAP Transcode Server - Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'QNAP Transcode Server Command Execution', 'Description' = %q This module exploits an unauthenticated remote command injection vulnerability in QN...

QNAP Transcode Server Command Execution

This module exploits an unauthenticated remote command injection vulnerability in QNAP NAS devices. The transcoding server listens on port 9251 by default and is vulnerable to command injection using the 'rmfile' command. This module was tested successfully on a QNAP TS-431 with firmware version...

CVE-2017-2223

Cross-site request forgery CSRF vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM2 firmware version 1.01 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM2 firmware version 1.01 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2017-2223

This CVE affects I-O DATA network cameras (TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC; and TS-WPTCAM2) with firmware 1.19 and earlier (and 1.01 and earlier for TS-WPTCAM2). The underlying issue is a Cross‑Site Request Forgery (CSRF) that allows remote attackers to hijack adminis...

CVE-2017-2223: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM2 firmware version 1.01 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

PT-2017-15272

Name of the Vulnerable Software and Affected Versions TS-WPTCAM versions 1.19 and earlier TS-PTCAM versions 1.19 and earlier TS-PTCAM/POE versions 1.19 and earlier TS-WLC2 versions 1.19 and earlier TS-WLCE versions 1.19 and earlier TS-WRLC versions 1.19 and earlier TS-WPTCAM2 versions 1.01 and...

doorsforbuilders.com XSS vulnerability

Vulnerable URL: http://www.doorsforbuilders.com/Paint-Grade-MDF-Door.php?Door=ts1000=TS-Series=Interior=1/-///'/"//--...

Multiple I-O DATA Network Camera Products Cross-Site Request Forgery Vulnerability

I-O DATA TS-WPTCAM and others are network cameras from I-O DATA DEVICE, Japan. A cross-site request forgery vulnerability exists in various I-O DATA Network Camera products using firmware version 1.19 and earlier. A remote attacker could exploit this vulnerability to perform unauthorized operatio...

JVN#65411235: Multiple I-O DATA network camera products vulnerable to cross-site request forgery

Multiple network camera products provided by I-O DATA DEVICE, INC. contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the Firmware Apply the appropriate firmware update...

CVE-2016-7819

I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2016-7814

I-O DATA DEVICE TS-WRLP firmware version 1.00.01 and earlier and TS-WRLA firmware version 1.00.01 and earlier allow remote attackers to obtain authentication credentials via unspecified vectors...

CVE-2016-7820

Buffer overflow in I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to cause a denial-of-service DoS or execute arbitrary code via unspecified vectors...