CVE-2017-9386

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "getfile.sh" which allows a user to retrieve any file stored in the "cmh-ext" folder on the device. However, the "filename" parameter is not validated correctly and this allows a...

CVE-2017-9389

CVE-2017-9389 affects Vera VeraEdge (1.7.19) and Veralite (1.7.481). The web UI allows users to install and write Lua applications without authentication. A POST carries user-provided Lua code to the LuaUPNP daemon, which handles it in LU::JobHandler_LuaUPnP::RunLua and passes the code to LU::Lua...

CVE-2017-9389

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device allows a user to install applications written in the Lua programming language. Also the interfa...

CVE-2017-9387

CVE-2017-9387 affects Vera VeraEdge 1.7.19 and Veralite 1.7.481. A shell script (relay.sh) creates SSH relays and logs all parameters to /tmp/log.relay; a companion log.sh reads those logs. Logs are served as text/html and processed by ansi2html, allowing an attacker to store an XSS payload in th...

CVE-2017-9390

Vulnerability CVE-2017-9390 affects Vera VeraEdge (1.7.19) and Veralite (1.7.481). The connect.sh script authenticates to home.getvera.com but fails to validate the RedirectURL parameter, allowing an attacker to execute client-side code in the application. This describes an input validation flaw ...

CVE-2017-9390

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return a specific cookie for the user when the user is authenticated to https://home.getvera.com. One of the parameters retrieved by this script ...

CVE-2017-9384

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports a...

CVE-2017-9381

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not implement any cross-site request forgery protection...

CVE-2017-9381

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not implement any cross-site request forgery protection...

CVE-2017-9384

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports a...

Design/Logic Flaw

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports a...

CVE-2017-9381

Vera VeraEdge (1.7.19) and Veralite (1.7.481) expose a CSRF vulnerability in their web management interface that allows an attacker to trick a logged-in user into installing or deleting apps. The root cause is the absence of cross-site request forgery protection, a systemic issue affecting other ...

CVE-2017-9388

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific...

Design/Logic Flaw

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific...

CVE-2017-9384

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports a...

CVE-2017-9384

The CVE-2017-9384 entry concerns Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device firmware includes relay.sh, a script used for establishing relay ports and Vera server communication. A parameter named remote_host is not sanitized and is concatenated into a subsequent script call via...

CVE-2017-9388

The CVE-2017-9388 issue affects Vera VeraEdge 1.7.19 and Veralite 1.7.481. A web UI feature includes a firmware file, proxy.sh, which proxies requests between the device and Vera’s website. The parameter url is not sanitized and is evaluated via eval to run curl, allowing an attacker to escape th...

CVE-2017-9388

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific...