Remote code execution

The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site...

CVE-2019-15123

The CVE-2019-15123 entry concerns Viki Vera 4.9.1.26180, specifically the Branding Module. An authenticated user can modify the site logo and upload a malicious .aspx file, enabling Remote Code Execution on the affected site. The vulnerability is described consistently across multiple sources (in...

CVE-2019-15123

The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site...

vera-groningen.nl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1006033 Security Researcher Hchabik Helped patch 2454 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting vera-groningen.nl website a...

Vera Edge Home Controller Command Injection Vulnerability

Vera Edge Home Controller is a smart home central control unit. A command injection vulnerability exists in the cgi-bin/cmh/webcam.sh file in Vera Edge Home Controller version 1.7.4452, which can be exploited by an attacker to execute illegal commands...

CVE-2019-15498

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

CVE-2019-15498

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

Design/Logic Flaw

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

CVE-2019-15498

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

CVE-2019-15498

CVE-2019-15498 affects Vera Edge Home Controller 1.7.4452. The vulnerability is a remote command-injection in the CGI script at cgi-bin/cmh/webcam.sh, exploitable by unauthenticated users via the username parameter’s --output argument injection, enabling arbitrary OS command execution. The issue ...

Vera Edge Home Controller Command Execution Vulnerability

Vera Edge Home Controller is a smart home central control unit. A security vulnerability exists in LuaUPnP in Vera Edge Home Controller version 1.7.4452. A remote attacker can exploit the vulnerability by sending the 'code' parameter to /port3480/datarequest to execute arbitrary operating system...

CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

Command injection

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

CVE-2019-13598

CVE-2019-13598 affects Vera Edge Home Controller (version 1.7.4452) via LuaUPnP. A remote, unauthenticated attacker can trigger arbitrary OS commands by passing the code parameter to /port_3480/data_request, because the expected safety check for unsafe Lua code is skipped. This is a remote code e...

CVE-2017-9391

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port3480". It seems that the UPnP services provide "requestimage" as one of the service actions for ...

CVE-2017-9392

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port3480". It seems that the UPnP services provide "requestimage" as one of the service actions for ...

CVE-2017-9385

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the...

CVE-2017-9385

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the...

CVE-2017-9390

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return a specific cookie for the user when the user is authenticated to https://home.getvera.com. One of the parameters retrieved by this script ...