Full Disclosure
Posted by hyp3rlinx on Mar 10
[+] Credits: John Page AKA hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt
[+] ISR: ApparitionSec
Vendor:
==============
solarwinds.com
www.serv-u.com
Product:
====================
FTP Voyager Scheduler
v16.2.0
Vulnerability Type:
=============================
CSRF Remote Command Execution
CVE Reference:
==============
N/A
Security…
Posted by Andrew Griffiths on Mar 10
SICUNET Physical Access Controller – Multiple Vulnerabilities
————————————————————-
Introduction
============
Multiple vulnerabilities were identified in the SICUNET Access Controller
Products. The vulnerabilities were discovered during a black box security
assessment and therefore the vulnerability list should not be considered
exhaustive.
Affected Software and Versions
==============================…
Posted by SEC Consult Vulnerability Lab on Mar 08
SEC Consult Vulnerability Lab Security Advisory < 20170308-0 >
=======================================================================
title: Multiple vulnerabilities
product: Navetti PricePoint
vulnerable version: 4.6.0.0
fixed version: 4.7.0.0 or higher
CVE number: –
impact: high/critical
homepage: http://www.navetti.com/
found: 2016-07-18
by:…
Posted by Pierre Kim on Mar 07
## Advisory Information
Title: Multiple vulnerabilities found in Wireless IP Camera (P2P)
WIFICAM cameras and vulnerabilities in GoAhead
Advisory URL: https://pierrekim.github.io/advisories/2017-goahead-camera-0x00.txt
Blog URL: https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html
Date published: 2017-03-08
Vendors contacted: None
Release mode: Released
CVE: no current CVE
## Product Description
The Wireless IP Camera (P2P)…
Posted by Indrajith AN on Mar 07
Title:
====
iball Baton 150M Wireless router – Authentication Bypass
Credit:
======
Name: Indrajith.A.N
Website: https://www.indrajithan.com
Date:
====
07-03-2017
Vendor:
======
iball Envisioning the tremendous potential for innovative products required
by the ever evolving users in computing and digital world, iBall was
launched in September 2001 and which is one of the leading networking
company
Product:
=======
iball Baton 150M Wireless-N…
Posted by Securify B.V. on Mar 07
————————————————————————
Stack-based buffer overflow in Western Digital My Cloud allows for
remote code execution
————————————————————————
Remco Vermeulen, January 2017
————————————————————————
Abstract
————————————————————————
It was discovered that the…
Posted by Securify B.V. on Mar 07
————————————————————————
Western Digital My Cloud vulnerable to Cross-Site Request Forgery
vulnerability
————————————————————————
Remco Vermeulen, January 2017
————————————————————————
Abstract
————————————————————————
It was discovered that the Western…
Posted by SEC Consult Vulnerability Lab on Mar 07
SEC Consult Vulnerability Lab Security Advisory < 20170307-0 >
=======================================================================
title: Unauthenticated OS command injection & arbitrary file upload
product: Western Digital My Cloud
vulnerable version: at least: 2.21.126 (My Cloud), 2.11.157(My Cloud EX2),
2.21.126 (My Cloud EX2 Ultra), 2.11.157 (My Cloud EX4),…
Posted by Securify B.V. on Mar 07
————————————————————————
Western Digital My Cloud vulnerable to multiple command injection
vulnerabilities
————————————————————————
Remco Vermeulen, January 2017
————————————————————————
Abstract
————————————————————————
It was discovered that the Western…
Posted by bashis on Mar 07
Greetings,
IPVM has published their independent report, along with their verification of the PoC and comments.
Below is the open link to the report I requested for Full Disclosure Community. (otherwise closed for IPVM members)
https://ipvm.com/reports/dahua-backdoor?code=bash
Have a nice day
/bashis
—–Original Message—–
From: Fulldisclosure <fulldisclosure-bounces () seclists org> on behalf of bashis <mcw () noemail eu>…