Philips Alice 6 Vulnerabilities (Update B)

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: Philips Equipment: Philips Alice 6 System product Vulnerabilities: Improper Authentication, Missing Encryption of Sensitive Data 2. UPDATE INFORMATION This updated...

payrollfree.com XSS vulnerability

Open Bug Bounty ID: OBB-591441 Description| Value ---|--- Affected Website:| payrollfree.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ModSecurity For Nginx Use-After-Free

Hey, TL;DR: UAF in a "non-release" version of ModSecurity for Nginx. !RCE|DoS, no need to panic. Plus some old and even older exploitation vectors. / 1. Use-After-Free UAF / During one of the engagements my team tested a WAF running in production Nginx + ModSecurity + OWASP Core Rule Set 123. In...

Omron CX-Supervisor (Update A)

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION : Low skill level to exploit Vendor : Omron Equipment : CX-Supervisor Vulnerabilities : Stack-based Buffer Overflow, Use After Free, Access of Uninitialized Pointer, Double Free, Out-of-bounds Write, Untrusted Pointer Dereference, Heap-based Buffer...

OSIsoft PI Data Archive

CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: OSIsoft Equipment: PI Data Archive Vulnerabilities: Deserialization of Untrusted Data, Improper Input Validation, Incorrect Default Permissions AFFECTED PRODUCTS The following versions of PI Data Archive, a data stora...

dragon15251.godo.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-568546 Description| Value ---|--- Affected Website:| dragon15251.godo.co.kr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-15352

Huawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5500 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5600 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5800 V3, V300R003C00, V300R003C10, V300R003C20 have an improp...

CVE-2017-15352

Huawei OceanStor family (2800 V3, 5300 V3, 5500 V3, 5600 V3, 5800 V3 with corresponding V300R003Cxx revisions) are affected by CVE-2017-15352: an improper access control vulnerability where access to a resource is not properly restricted. The result is that a user with high privileges may query i...

Vyaire Medical CareFusion Upgrade Utility Vulnerability

OVERVIEW Independent researcher Mark Cross @xerubus has identified an uncontrolled search path element vulnerability in Vyaire Medical’s CareFusion Upgrade Utility application. Vyaire Medical has produced an update that mitigates this vulnerability. AFFECTED PRODUCTS The following versions of...

Code injection

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...

almanalmagazine.com XSS vulnerability

Open Bug Bounty ID: OBB-548090 Description| Value ---|--- Affected Website:| almanalmagazine.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...

Siemens Desigo PXC (Update C)

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Belkin N600DB Command Injection / Backdoor

Exploit Title: Belkin N600DB Wireless Router | Multiple Vulnerabilities Date: 16/01/2018 Exploit Author: Wadeek Hardware Version: F9K1102as v3 Firmware Version: 3.04.11 Vendor Homepage: http://www.belkin.com/fr/support/product/?pid=F9K1102as Firmware Link:...

CVE-2018-5330

ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service router unreachable/unresponsive via a flood of fragmented UDP packets...

CVE-2018-5330

CVE-2018-5330 affects ZyXEL P-660HW v3 devices. Multiple connected sources (CNVD-2018-04321, NVD/NVD mirror) describe a remote denial of service caused by a flood of fragmented UDP packets that renders the router unreachable/unresponsive. The CNVD entry confirms vulnerability in ZyXEL P-660HW ver...

CVE-2018-5330

ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service router unreachable/unresponsive via a flood of fragmented UDP packets...

schuetzen.scheffau.net XSS vulnerability

Open Bug Bounty ID: OBB-511918 Description| Value ---|--- Affected Website:| schuetzen.scheffau.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Moxa MXview

CVSS v3 7.8 ATTENTION: Low skill level to exploit. Vendor: Moxa Equipment: MXview Vulnerability: Unquoted Search Path or Element. AFFECTED PRODUCTS The following versions of MXview, network management software, are affected: MXview v2.8 and prior. IMPACT Successful exploitation of this...

iland.tv XSS vulnerability

Open Bug Bounty ID: OBB-488339 Description| Value ---|--- Affected Website:| iland.tv Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on I...

Delta Electronics Delta Industrial Automation Screen Editor

CVSS v3 5.5 ATTENTION: Low skill level to exploit. Vendor: Delta Electronics, Incorporated Delta Electronics Equipment: Delta Industrial Automation Screen Editor Vulnerabilities: Stack-based Buffer Overflow, Use-after-Free, Out-of-bounds Write, Type Confusion AFFECTED PRODUCTS The following...