CVE-2023-26316

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies...

PT-2023-20607 · Xiaomi · Xiaomi Cloud Service Application

Name of the Vulnerable Software and Affected Versions: Xiaomi cloud service Application product affected versions not specified Description: A XSS issue exists in the Xiaomi cloud service Application product. The issue is caused by Webview's whitelist checking function allowing the javascript...

CVE-2023-26317 Xiaomi router external request interface has command injection

Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing...

Xiaomi cloud service Application 跨站脚本漏洞

Xiaomi cloud service Application is a cloud service APP from Xiaomi, a Chinese company. A cross-site scripting vulnerability exists in Xiaomi cloud service Application, which stems from a whitelist checking feature that allows loading of the javascript protocol, which can be exploited by an...

CVE-2023-26317

The CVE-2023-26317 entry concerns Xiaomi routers with an external interface that can be abused to perform command injection. The root cause is lax filtering of responses from the external interface, enabling an attacker to hijack ISP routing or an upper-layer route to gain unauthorized access and...

CVE-2023-26316

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies...

Predator Android Spyware: Researchers Uncover New Data Theft Capabilities

Security researchers have detailed the inner workings of the commercial Android spyware called Predator, which is marketed by the Israeli company Intellexa previously Cytrox. Predator was first documented by Google's Threat Analysis Group TAG in May 2022 as part of attacks leveraging five differe...

CVE-2020-14140

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute...

CVE-2020-14140

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute...

Command injection

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute...

Xiaomi router 访问控制错误漏洞

Xiaomi router is a series of wireless routers from Chinese company Xiaomi. A security vulnerability exists in firmware version 2020 of the Xiaomi router, which stems from the lack of access control policies on some API interfaces, which could lead to WIFI password leakage and allow attackers to...

PT-2023-11474 · Xiaomi · Xiaomi Router Firmware

Name of the Vulnerable Software and Affected Versions: Xiaomi router firmware affected versions not specified Description: The issue is caused by the lack of access control policies on some API interfaces, allowing attackers to exploit an unauthenticated API and reveal the WIFI password. This can...

CVE-2020-14140

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute...

CVE-2020-14140

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute...

CVE-2020-14140

The CVE-2020-14140 entry concerns Xiaomi router firmware. Affected component: router API interfaces lacking access control, leading to an unauthenticated API that can reveal the WIFI password. Root cause: insufficient access control on certain API endpoints, enabling unauthorized access. Impact: ...

SUSE CVE-2019-8413

On Xiaomi MIX 2 devices with the 4.4.78 kernel, a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/elliptic0 causes a system crash via IOCTL 0x4008c575 aka decimal 1074316661...

CVE-2020-14131

The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center MiSRC to jointly ensure the safe access of millions of Xiaomi users worldwide Life...

CVE-2020-14129

A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege...

Authentication flaw

The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center MiSRC to jointly ensure the safe access of millions of Xiaomi users worldwide Life...

Privilege escalation

A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege...