Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
accessed by the running code. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171009_00 - http://www.securityfocus.com/bid/101498
CVE ID: CVE-2017-13684 State: PUBLISHED Published: 2017-09-29T20:00:00 Last Updated: 2024-08-05T19:05:19.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys Libra 64xx and 84xx and FS601 class systems with MCP-FIRMWARE before 43.211 allow remote authenticated users to cause a denial of service (program crash) or have unspecified other impact via vectors related to incorrect literal handling, which trigger CPM stack corruption. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=44
CVE ID: CVE-2017-13685 State: PUBLISHED Published: 2017-08-29T06:00:00 Last Updated: 2024-08-05T19:05:19.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg105314.html - http://www.securityfocus.com/bid/100521 - https://usn.ubuntu.com/4019-1/ - https://usn.ubuntu.com/4019-2/
CVE ID: CVE-2017-13686 State: PUBLISHED Published: 2017-08-24T22:00:00Z Last Updated: 2024-09-16T19:04:47.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_MATCH is set, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via crafted system calls. NOTE: this does not affect any stable release. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/bc3aae2bbac46dd894c89db5d5e98f7f0ef9e205 - http://git.kernel.org/cgit/linux/kernel/git/torvalds
om/torvalds/linux/commit/bc3aae2bbac46dd894c89db5d5e98f7f0ef9e205 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bc3aae2bbac46dd894c89db5d5e98f7f0ef9e205
CVE ID: CVE-2017-13687 State: PUBLISHED Published: 2017-09-14T06:00:00 Last Updated: 2024-08-05T19:05:19.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print(). Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-23 - https://github.com/the-tcpdump-group/tcpdump/commit/a1eefe986065846b6c69dbc09afd9fa1a02c4a3d - https://support.apple.com/HT208221 - http://www.debian.org/security/2017/dsa-3971 - http://www.securitytracker.com/id/1039307 - http://www.tcpdump.org/tcpdump-changes.txt - https://github.com/the-tcpdump-group/tcpdump/commit/
acker.com/id/1039307 - http://www.tcpdump.org/tcpdump-changes.txt - https://github.com/the-tcpdump-group/tcpdump/commit/866c60236c41cea1e1654c8a071897292f64be49 - https://access.redhat.com/errata/RHEA-2018:0705
CVE ID: CVE-2017-13688 State: PUBLISHED Published: 2017-09-14T06:00:00 Last Updated: 2024-08-05T19:05:19.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print(). Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-23 - https://support.apple.com/HT208221 - http://www.debian.org/security/2017/dsa-3971 - http://www.securitytracker.com/id/1039307 - https://github.com/the-tcpdump-group/tcpdump/commit/0cb1b8a434b599b8d636db029aadb757c24e39d6 - http://www.tcpdump.org/tcpdump-changes.txt - https://access.redhat.com/errata/RHEA-2018:0705
CVE ID: CVE-2017-13689 State: PUBLISHED Published: 2017-09-14T06:00:00 Last Updated: 2024-08-05T19:05:19.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print(). Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-23 - https://support.apple.com/HT208221 - http://www.debian.org/security/2017/dsa-3971 - http://www.securitytracker.com/id/1039307 - https://github.com/the-tcpdump-group/tcpdump/commit/061e7371a944588f231cb1b66d6fb070b646e376 - http://www.tcpdump.org/tcpdump-changes.txt - https://access.redhat.com/errata/RHEA-2018:0705
CVE ID: CVE-2017-13690 State: PUBLISHED Published: 2017-09-14T06:00:00 Last Updated: 2024-08-05T19:05:19.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-23 - https://support.apple.com/HT208221 - http://www.debian.org/security/2017/dsa-3971 - http://www.securitytracker.com/id/1039307 - https://github.com/the-tcpdump-group/tcpdump/commit/8dca25d26c7ca2caf6138267f6f17111212c156e - http://www.tcpdump.org/tcpdump-changes.txt - https://access.redhat.com/errata/RHEA-2018:0705
CVE ID: CVE-2017-13692 State: PUBLISHED Published: 2017-08-25T07:00:00 Last Updated: 2024-08-05T19:05:19.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault), as demonstrated by an invalid ISALNUM argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/htacg/tidy-html5/issues/588 - http://www.securityfocus.com/bid/100506
CVE ID: CVE-2017-13693 State: PUBLISHED Published: 2017-08-25T07:00:00 Last Updated: 2024-12-18T17:51:08.285597Z Vendors: n/a Products: n/a Problem Types: n/a Description: The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.kernel.org/patch/9919053/ - https://github.com/acpica/acpica/pull/295/commits/987a3b5cf7175916e2a4b6e
https://patchwork.kernel.org/patch/9919053/ - https://github.com/acpica/acpica/pull/295/commits/987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 - http://www.securityfocus.com/bid/100502 - https://github.com/acpica/acpica/pull/295
CVE ID: CVE-2017-13694 State: PUBLISHED Published: 2017-08-25T07:00:00 Last Updated: 2024-12-18T17:46:10.230155Z Vendors: n/a Products: n/a Problem Types: n/a Description: The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.kernel.org/patch/9806085/ - http://www.securityfocus.com/bid/100500 - https://github.co
References: - https://patchwork.kernel.org/patch/9806085/ - http://www.securityfocus.com/bid/100500 - https://github.com/acpica/acpica/pull/278/commits/4a0243ecb4c94e2d73510d096c5ea4d0711fc6c0 - https://github.com/acpica/acpica/pull/278
CVE ID: CVE-2017-13695 State: PUBLISHED Published: 2017-08-25T07:00:00 Last Updated: 2024-08-05T19:05:19.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3696-1/ - https://usn.ubuntu.com/3762-1/ - http://www.securityfocus.com/bid/100497 - https://usn.ubuntu.com
n.ubuntu.com/3696-1/ - https://usn.ubuntu.com/3762-1/ - http://www.securityfocus.com/bid/100497 - https://usn.ubuntu.com/3762-2/ - https://usn.ubuntu.com/3696-2/ - https://github.com/acpica/acpica/pull/296/commits/37f2c716f2c6ab14c3ba557a539c3ee3224931b5 - https://patchwork.kernel.org/patch/9850567/
CVE ID: CVE-2017-13696 State: PUBLISHED Published: 2018-01-24T15:00:00 Last Updated: 2024-08-05T19:05:20.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request. Additional Ana
vel privileges. The vulnerability lies due to improper handling and sanitization of the incoming request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42557 - https://www.exploit-db.com/exploits/42560/ - https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_get - https://www.exploit-db.com/exploits/42559/ - https://www.exploit-db.com/exploits/42558/
CVE ID: CVE-2017-13697 State: PUBLISHED Published: 2017-08-25T17:00:00Z Last Updated: 2024-09-17T01:11:04.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.bendawang.site/article/The-latest-version-of-finecms-unlimited-XSS
CVE ID: CVE-2017-13698 State: PUBLISHED Published: 2017-11-23T21:00:00 Last Updated: 2024-08-05T19:05:19.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. An attacker could extract public and private keys from the firmware image available on the MOXA website and could use them against a production switch that has the default keys embedded. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf
CVE ID: CVE-2017-13699 State: PUBLISHED Published: 2017-11-23T21:00:00 Last Updated: 2024-08-05T19:05:20.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to retrieve it. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf - http://www.securityfocus.com/bid/106047
CVE ID: CVE-2017-13700 State: PUBLISHED Published: 2017-11-17T18:00:00 Last Updated: 2024-08-05T19:05:19.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentryo.net/fr/sentryo-analyse-switch-industriel/
CVE ID: CVE-2017-13701 State: PUBLISHED Published: 2017-11-23T21:00:00 Last Updated: 2024-08-05T19:05:20.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf - http://www.securityfocus.com/bid/101966
CVE ID: CVE-2017-13702 State: PUBLISHED Published: 2017-11-17T18:00:00 Last Updated: 2024-08-05T19:05:20.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentryo.net/fr/sentryo-analyse-switch-industriel/
CVE ID: CVE-2017-13703 State: PUBLISHED Published: 2017-11-17T18:00:00 Last Updated: 2024-08-05T19:05:19.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. A denial of service may occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentryo.net/fr/sentryo-analyse-switch-industriel/
CVE ID: CVE-2017-13704 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T19:05:20.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039474 - https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.s
m/support/security/Synology_SA_17_59_Dnsmasq - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.securityfocus.com/bid/101977 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TK6DWC53WSU6633EVZL7H4PCWBYHMHK/ - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=63437ffbb58837b214b4b92cb1c54bc5f3279928 - http://thekelleys.org.uk/dnsmasq/CHANGELOG - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thek
oogleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html - https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf
CVE ID: CVE-2017-13706 State: PUBLISHED Published: 2017-10-10T13:00:00 Last Updated: 2024-08-05T19:05:20.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery (SSRF) attacks, conduct internal port scans, or have unspecified other impact via an XML request, aka bug #572705. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Oct/14 - https://www.lansweeper.com/changelog.as
rogram Container: References: - http://seclists.org/fulldisclosure/2017/Oct/14 - https://www.lansweeper.com/changelog.aspx - http://packetstormsecurity.com/files/144527/Lansweeper-6.0.100.29-XXE-Injection.html
CVE ID: CVE-2017-13707 State: PUBLISHED Published: 2017-08-27T15:00:00 Last Updated: 2024-08-05T19:05:19.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command execution. The vi program can be accessed through sudo, in order to navigate the filesystem and modify a critical file such as /etc/passwd. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Wh1t3Rh1n0/exploits/blob/master/2017-08-25%20Replibit%20Backup%20Manager/README.md
CVE ID: CVE-2017-13708 State: PUBLISHED Published: 2017-08-31T14:00:00 Last Updated: 2024-08-05T19:05:20.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GET request. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/143949/VX-Search-Enterprise-10.0.14-Buffer-Overflow.html
CVE ID: CVE-2017-13709 State: PUBLISHED Published: 2017-08-27T16:00:00 Last Updated: 2024-08-05T19:05:19.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/flightgear/flightgear/ci/2a5e3d06b2c0d9f831063afe7e7260bca456d679/ - https://sourceforge.net/p/flightgear/flightgear/ci/c7a2aef59979af3e9ff22daabb37bdaadb91cd75/
CVE ID: CVE-2017-13710 State: PUBLISHED Published: 2017-08-27T16:00:00 Last Updated: 2024-08-05T19:05:19.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100499 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0c54f69295208331faab9bc5e995111a35672f9b
CVE ID: CVE-2017-13711 State: PUBLISHED Published: 2017-09-01T13:00:00 Last Updated: 2024-08-05T19:05:19.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100534 - https://access.redhat.com/errata/RHSA-2018:0816 - http://www.openwall.com/lists/oss-security/2017/08/29/6 - http://www.debian.org/security/2017/dsa-3991 - https://access.redhat.com/errata/
l.com/lists/oss-security/2017/08/29/6 - http://www.debian.org/security/2017/dsa-3991 - https://access.redhat.com/errata/RHSA-2018:1104 - https://access.redhat.com/errata/RHSA-2018:1113 - https://bugzilla.redhat.com/show_bug.cgi?id=1486400 - https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg05201.html
CVE ID: CVE-2017-13712 State: PUBLISHED Published: 2017-08-28T19:00:00 Last Updated: 2024-08-05T19:05:19.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/lame/bugs/472/ - http://www.securityfocus.com/bid/100525
CVE ID: CVE-2017-13713 State: PUBLISHED Published: 2017-09-07T13:00:00 Last Updated: 2024-08-05T19:05:20.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42608/ - http://packetstormsecurity.com/files/143978/Wireless-Repeater-BE126-Remote-Code-Execution.html
CVE ID: CVE-2017-13715 State: PUBLISHED Published: 2017-08-28T20:00:00 Last Updated: 2024-08-05T19:05:20.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100517 - http://seclists.org/oss-sec/2017/q3/345 - https://github.com/torvalds/linux/commit/a6e544b0a88b53114bfa5a57e21b7be7a8dfc9d
tp://seclists.org/oss-sec/2017/q3/345 - https://github.com/torvalds/linux/commit/a6e544b0a88b53114bfa5a57e21b7be7a8dfc9d0 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a6e544b0a88b53114bfa5a57e21b7be7a8dfc9d0
CVE ID: CVE-2017-13716 State: PUBLISHED Published: 2017-08-28T21:00:00Z Last Updated: 2024-09-16T18:34:35.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd). Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22009
CVE ID: CVE-2017-13717 State: PUBLISHED Published: 2019-06-10T21:35:19 Last Updated: 2024-08-05T19:05:19.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are stored in clear text on the device and can be pulled easily. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/
: References: - https://seclists.org/bugtraq/2019/Jun/8 - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdf - http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.html
CVE ID: CVE-2017-13718 State: PUBLISHED Published: 2019-06-10T21:31:30 Last Updated: 2024-08-05T19:05:19.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows an attacker to change the Wi-Fi settings and PIN, as well as port forward and expose any internal device's port to the Internet. It was identified that the device uses custom Python code called "rodman" that allows the mobile appication to interact with the device. The APIs that are a part of this rodman Python file allow the mobile application to interact with the device using a secret, w
Is that are a part of this rodman Python file allow the mobile application to interact with the device using a secret, which is a uuid4 based session identifier generated by the device the first time it is set up. However, in some cases, these APIs can also use a security code. This security code is nothing but the PIN number set by the user to interact with the device when using the touch interface on the router. This allows an attacker on the Internet to interact with the router's HTTP interface when a user navigates to the attacker's website, and brute force the credentials. Also, since the device's server sets the Access-Control-Allow-Origin header to "*", an attacker can easily interact