CVE-2019-5456

CVE-2019-5456 concerns the UniFi Controller prior to version 5.10.22. An attacker can set up an SMTP proxy between the UniFi Controller (versions ≤ 5.10.21) and the real SMTP server to capture SMTP credentials, enabling a MITM-like credential theft via misrouted mail traffic. The connected docume...

CVE-2019-5456

SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version = 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later...

PT-2019-17685 · Ubiquiti · Unifi Controller

Name of the Vulnerable Software and Affected Versions: UniFi Controller versions prior to 5.10.22 Description: A malicious actor can set up an SMTP proxy server between the UniFi Controller and the actual SMTP server to record SMTP credentials for later malicious use. Recommendations: For version...

CVE-2019-5456: Channel Accessible by Non-Endpoint

SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version = 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later...

Ubiquiti Inc.: Catch mails sent to an SMTP Server over SSL using an Evil SMTP Server

A malicious actor setting up an SMTP proxy server between the UniFi Controller and their actual SMTP server can record their SMTP credentials for malicious use...

Multi Gather Ubiquiti UniFi Controller Backup

On an Ubiquiti UniFi controller, reads the system.properties configuration file and downloads the backup and autobackup files. The files are then decrypted using a known encryption key, then attempted to be repaired by zip. Meterpreter must be used due to the large file sizes, which can be flaky ...

CVE-2014-2226

Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

Design/Logic Flaw

Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

CVE-2014-2226

Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

CVE-2014-2226

CVE-2014-2226 affects Ubiquiti UniFi Controller prior to 3.2.1. The issue is that the admin password hash is logged in syslog messages, enabling an attacker with access to the syslog stream to obtain sensitive authentication data. Public details reference that when remote logging is enabled, sysl...

CVE-2014-2226: Undefined Security Weakness

Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

PT-2014-4566

Name of the Vulnerable Software and Affected Versions Ubiquiti UniFi Controller versions prior to 3.2.1 Description The issue allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as the administrative password hash is logged in syslog messages. Recommendatio...

Ubiquiti UbiFi mFi AirVision - Cross-Site Request Forgery

Ubiquiti UbiFi mFi AirVision - Cross-Site Request Forgery Vendor Homepage: http://www.ubnt.com/ Tested on: Kali Linux ----------------------------------------- Affected Products/Versions: ----------------------------------------- UniFi Controller v2.4.6 mFi Controller v2.0.15 AirVision Controller...

Ubiquiti UbiFi Controller 2.4.5 Password Hash Disclosure

----------- Vendor: ----------- Ubiquiti Networks http://www.ubnt.com/ ---------------------------------------------- Affected Products/Versions: ---------------------------------------------- UniFi Controller v2.4.6 Note: Previous versions may be affected ----------------- Description:...

Ubiquiti UniFi Controller DHCP Hostname脚本注入漏洞

CVE ID:CVE-2013-3572 Ubiquiti Networks UniFi是一款企业级无线网络系统。 Ubiquiti Networks UniFi中的UniFi Controller管理接口存在跨站脚本漏洞，允许远程攻击者利用漏洞通过特制的客户端主机名，注入恶意脚本或HTML代码，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 Ubiquiti UniFi Controller 2.x 厂商补丁： Ubiquiti Networks ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...

Cross site scripting

Cross-site scripting XSS vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname...

CVE-2013-3572

UniFi Controller (Ubiquiti) 2.x before 2.3.5 is affected by an XSS in the administer interface. A crafted client hostname can cause remote attackers to inject arbitrary script/HTML, potentially exposing sensitive data or session hijacking when the payload is rendered. Root cause: insufficient inp...

CVE-2013-3572

Cross-site scripting XSS vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname...

CVE-2013-3572: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname...

PT-2013-4484 · Ubiquiti Networks · Unifi

Name of the Vulnerable Software and Affected Versions: Ubiquiti Networks UniFi versions 2.3.5 and earlier Description: A cross-site scripting XSS issue exists in the administer interface of the UniFi Controller, allowing remote attackers to inject arbitrary web script or HTML via a crafted client...