1823 matches found
NewStart CGSL CORE 5.04 / MAIN 5.04 : python-jinja2 Vulnerability (NS-SA-2019-0078)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python-jinja2 packages installed that are affected by a vulnerability: - In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. CVE-2016-10745 Note that Nessus has not tested for this issue but has instead relie...
NewStart CGSL CORE 5.04 / MAIN 5.04 : ovmf Vulnerability (NS-SA-2019-0076)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ovmf packages installed that are affected by a vulnerability: - Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or...
NewStart CGSL CORE 5.04 / MAIN 5.04 : wget Vulnerability (NS-SA-2019-0079)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has wget packages installed that are affected by a vulnerability: - Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service DoS or may execute an arbitrary code via unspecified vector...
NewStart CGSL CORE 5.04 / MAIN 5.04 : libvorbis Vulnerability (NS-SA-2019-0026)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libvorbis packages installed that are affected by a vulnerability: - An out of bounds write flaw was found in the processing of vorbis audio data. A maliciously crafted file or audio stream could cause the application to...
NewStart CGSL CORE 5.04 / MAIN 5.04 : gcab Vulnerability (NS-SA-2019-0020)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has gcab packages installed that are affected by a vulnerability: - A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code...
NewStart CGSL MAIN 4.05 : libvorbis Vulnerability (NS-SA-2019-0122)
The remote NewStart CGSL host, running version MAIN 4.05, has libvorbis packages installed that are affected by a vulnerability: - An out of bounds write flaw was found in the processing of vorbis audio data. A maliciously crafted file or audio stream could cause the application to crash or,...
NewStart CGSL MAIN 5.04 : liblouis Vulnerability (NS-SA-2019-0004)
The remote NewStart CGSL host, running version MAIN 5.04, has liblouis packages installed that are affected by a vulnerability: - A missing fix for one stack-based buffer overflow in findTable for CVE-2014-8184 was discovered. An attacker could cause denial of service or potentially allow arbitra...
NewStart CGSL MAIN 4.05 : apr Vulnerability (NS-SA-2019-0115)
The remote NewStart CGSL host, running version MAIN 4.05, has apr packages installed that are affected by a vulnerability: - An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lea...
NewStart CGSL CORE 5.04 / MAIN 5.04 : corosync Vulnerability (NS-SA-2019-0046)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has corosync packages installed that are affected by a vulnerability: - An integer overflow leading to an out-of-bound read was found in authenticatenss23 in Corosync. An attacker could craft a malicious packet that would lead ...
NewStart CGSL CORE 5.04 / MAIN 5.04 : libXcursor Vulnerability (NS-SA-2019-0048)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libXcursor packages installed that are affected by a vulnerability: - XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a...
Reverse Engineering 4G Hotspots for fun, bugs and net financial loss
a.k.a. 4G hotspots and their Discontents You might be here because you saw our talk at Defcon 27. You might want to watch that for the full rundown! TL;DR We found multiple vulnerabilities in several well known vendors Mi-Fi devices, including pre- and post-auth command injection and code executi...
ZTE MF910 – An end of life router, running lots of vivacious hidden code
You might be here because you saw our talk at Defcon 27. You might want to watch that for the full rundown! The ZTE MF910 is a really interesting router for reversing, mainly because it’s full of nice debug calls, and underused functionality. Also, it’s never going to get patched, and it’s really...
CVE-2019-3414
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...
CVE-2019-3414
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...
Cross site scripting
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...
CVE-2019-3414
CVE-2019-3414 affects ZTE OTCP before 1.19.20.02, with an XSS vulnerability exploitable when a attacker uses security management to access resources tied to a user’s operation code. The malicious script can be transmitted in the parameter and, if the frontend fails to properly handle the interfac...
CVE-2019-3414
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...
ZTE OTCP Cross-Site Scripting Vulnerability
ZTE OTCP is a set of next-generation network management platform products from China's ZTE Corporation ZTE. A cross-site scripting vulnerability exists in ZTE OTCP 1.19.20.02 and earlier versions. The vulnerability stems from the lack of proper validation of client data by the WEB application. An...