VARIoT IoT vulnerabilities database

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by first entering input within the web-based management interface and then persuading a user of the interface to view the crafted input within the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authentication. Any access reboots the device, rendering it therefore unusable for several minutes. D-Link DSR-250N The device is vulnerable to a lack of authentication for critical features.Denial of service (DoS) It may be put into a state. D-Link DSR-250N is a unified service router produced by D-Link in Taiwan

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access confidential information or make configuration changes. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to read confidential information or make configuration changes. This vulnerability stems from network systems or products not properly restricting access to resources from unauthorized roles

A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated, remote attacker to perform a directory traversal attack on an affected device. The vulnerability is due to insufficient validation of configuration backup files. An attacker could exploit this vulnerability by persuading an administrator to restore a crafted configuration backup file. A successful exploit could allow the attacker to overwrite arbitrary files that are accessible through the affected software on an affected device. Cisco Nexus Data Broker is a network routing monitoring solution of Cisco (Cisco). The software is event-driven and can provide real-time network flow visualization

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution. plural Apple The product is vulnerable to a buffer overflow due to improper memory processing.Arbitrary code can be executed by processing maliciously created images. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the CoreGraphics library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the JBIG2Bitmap::expand method. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple iPadOS is an operating system for iPad tablets

Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerability. Authenticated low privileged OMIMSCC users may be able to retrieve sensitive information from the logs. Dell EMC OpenManage Integration is a driver for a virtualization management console of Dell. Tools and tasks related to managing and deploying servers in virtual environments are simplified. This vulnerability originates from the abnormal output of log files of network systems or products

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface. Cisco SD-WAN vManage The software contains a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. Cisco SD-WAN vManage Software is a management software for SD-WAN (Software Defined Wide Area Network) solutions from Cisco. The vulnerability stems from the lack of correct validation of client data in WEB applications

A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker needs valid credentials on the Windows system. The vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file in a specific location on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with the privileges of another user’s account. Cisco Webex Teams is a team collaboration application of Cisco (Cisco). The program includes video conferencing, group messaging and file sharing capabilities. A code issue vulnerability exists in Cisco Webex Teams. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products

A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute arbitrary code on an affected device or cause the device to reload. This vulnerability is due to missing checks when an IP camera processes a Cisco Discovery Protocol packet. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute code on the affected IP camera or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). plural Cisco Video Surveillance 8000 series IP A buffer error vulnerability exists in the camera.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service. MikroTik RouterOS Exists in an integer overflow vulnerability.Denial of service (DoS) It may be put into a state. MikroTik RouterOS is a Linux-based router operating system developed by Latvian MikroTik Company. The system can be deployed in a PC so that it provides router functionality

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Google Chrome is a web browser developed by Google (Google). Chrome has security holes. For the stable distribution (buster), these problems have been fixed in version 78.4.0esr-1~deb10u2. We recommend that you upgrade your firefox-esr packages. 8) - aarch64, ppc64le, s390x, x86_64 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-12-14-7 tvOS 14.3 tvOS 14.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212005. CoreAudio Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-27948: JunDong Xie of Ant Security Light-Year Lab FontParser Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An information disclosure issue was addressed with improved state management. CVE-2020-27946: Mateusz Jurczyk of Google Project Zero FontParser Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. CVE-2020-27943: Mateusz Jurczyk of Google Project Zero CVE-2020-27944: Mateusz Jurczyk of Google Project Zero ImageIO Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to heap corruption Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-29617: XingWei Lin of Ant Security Light-Year Lab CVE-2020-29619: XingWei Lin of Ant Security Light-Year Lab ImageIO Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-29618: XingWei Lin of Ant Security Light-Year Lab ImageIO Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-29611: Ivan Fratric of Google Project Zero WebRTC Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-15969: an anonymous researcher Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAl/YBnkACgkQZcsbuWJ6 jjAdUA/+IW1Va0vmKcDFand0B8Y1lkRDdThXQ/lQmLJCPNJ1hQLQZSLUzpYvjyLi UAepoh/ToYtt9YivitmjfNHxjLvYw/xRV13cpsVMcCvQhhS1N5s4aJEL6f+0LEhv 6U0JvjGoa6/By4sQksdPZnipoNRzEJ3KWRJrFkLnGwvH+uT6KbuzjXqfHwkHJfV2 XgghEJzvoLT1cbXp6XNO/YOV++eeDBkW0L80YukQ2RPDHi3N99Aue9ADe+pbQJH1 eJBWdZV99zjHZrStXKBQ7CF5i9hJnludrMo0V+RgMXRhLrfW5dm6Ww3kLm4okj+D spAJy8WepCRFwth9+yFcmdxyv2aZJ0MvxuFAIL6Sv9E0FvMW8fPbRHcsJDDTAt4f mKUPwUex183P7li3SYEK/I1ItcMh039wlulkiP5xw/6JGDIDh7ryOaTPCvnz+MIx OzcgtdNFLcTA2BDEQwITEp+fpuqAlXw3ykbq5yYZz3AJXxKLVXVLeuB1oEkHJmRi 4EUXb7Lb5TEoMj1dbCmmr6q3eWGCPj5CJcTFJMTNWx8aW4u889mi7FqCnXasAc3M jg5eSRy+97+tOsdgUYFoMekJqF8jJbljDH1NDmEbMtVc+F7jT4khXN9fRLvqN6An P4web66vaHKZbUnMDtXHjMSkfniHUT39JKm7CJPNC/vf2HF9HQM=4OzT -----END PGP SIGNATURE----- . 6) - i386, i686, x86_64 3. Security Fix(es): * chromium-browser: Use after free in payments (CVE-2020-15967) * chromium-browser: Use after free in Blink (CVE-2020-15968) * chromium-browser: Use after free in WebRTC (CVE-2020-15969) * chromium-browser: Use after free in NFC (CVE-2020-15970) * chromium-browser: Use after free in printing (CVE-2020-15971) * chromium-browser: Use after free in audio (CVE-2020-15972) * chromium-browser: Use after free in autofill (CVE-2020-15990) * chromium-browser: Use after free in password manager (CVE-2020-15991) * chromium-browser: Inappropriate implementation in networking (CVE-2020-6557) * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-15973) * chromium-browser: Integer overflow in Blink (CVE-2020-15974) * chromium-browser: Integer overflow in SwiftShader (CVE-2020-15975) * chromium-browser: Use after free in WebXR (CVE-2020-15976) * chromium-browser: Insufficient data validation in dialogs (CVE-2020-15977) * chromium-browser: Insufficient data validation in navigation (CVE-2020-15978) * chromium-browser: Inappropriate implementation in V8 (CVE-2020-15979) * chromium-browser: Insufficient policy enforcement in Intents (CVE-2020-15980) * chromium-browser: Out of bounds read in audio (CVE-2020-15981) * chromium-browser: Side-channel information leakage in cache (CVE-2020-15982) * chromium-browser: Insufficient data validation in webUI (CVE-2020-15983) * chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2020-15984) * chromium-browser: Inappropriate implementation in Blink (CVE-2020-15985) * chromium-browser: Integer overflow in media (CVE-2020-15986) * chromium-browser: Use after free in WebRTC (CVE-2020-15987) * chromium-browser: Insufficient policy enforcement in networking (CVE-2020-15992) * chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-15988) * chromium-browser: Uninitialized use in PDFium (CVE-2020-15989) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bugs fixed (https://bugzilla.redhat.com/): 1885883 - CVE-2020-15967 chromium-browser: Use after free in payments 1885884 - CVE-2020-15968 chromium-browser: Use after free in Blink 1885885 - CVE-2020-15969 chromium-browser: Use after free in WebRTC 1885886 - CVE-2020-15970 chromium-browser: Use after free in NFC 1885887 - CVE-2020-15971 chromium-browser: Use after free in printing 1885888 - CVE-2020-15972 chromium-browser: Use after free in audio 1885889 - CVE-2020-15990 chromium-browser: Use after free in autofill 1885890 - CVE-2020-15991 chromium-browser: Use after free in password manager 1885891 - CVE-2020-15973 chromium-browser: Insufficient policy enforcement in extensions 1885892 - CVE-2020-15974 chromium-browser: Integer overflow in Blink 1885893 - CVE-2020-15975 chromium-browser: Integer overflow in SwiftShader 1885894 - CVE-2020-15976 chromium-browser: Use after free in WebXR 1885896 - CVE-2020-6557 chromium-browser: Inappropriate implementation in networking 1885897 - CVE-2020-15977 chromium-browser: Insufficient data validation in dialogs 1885899 - CVE-2020-15978 chromium-browser: Insufficient data validation in navigation 1885901 - CVE-2020-15979 chromium-browser: Inappropriate implementation in V8 1885902 - CVE-2020-15980 chromium-browser: Insufficient policy enforcement in Intents 1885903 - CVE-2020-15981 chromium-browser: Out of bounds read in audio 1885904 - CVE-2020-15982 chromium-browser: Side-channel information leakage in cache 1885905 - CVE-2020-15983 chromium-browser: Insufficient data validation in webUI 1885906 - CVE-2020-15984 chromium-browser: Insufficient policy enforcement in Omnibox 1885907 - CVE-2020-15985 chromium-browser: Inappropriate implementation in Blink 1885908 - CVE-2020-15986 chromium-browser: Integer overflow in media 1885909 - CVE-2020-15987 chromium-browser: Use after free in WebRTC 1885910 - CVE-2020-15992 chromium-browser: Insufficient policy enforcement in networking 1885911 - CVE-2020-15988 chromium-browser: Insufficient policy enforcement in downloads 1885912 - CVE-2020-15989 chromium-browser: Uninitialized use in PDFium 6. 8.0) - ppc64le, x86_64 3. 8.2) - aarch64, ppc64le, x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: firefox security update Advisory ID: RHSA-2020:4310-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4310 Issue date: 2020-10-22 CVE Names: CVE-2020-15683 CVE-2020-15969 ==================================================================== 1. Summary: An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.4.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683) * chromium-browser: Use after free in WebRTC (CVE-2020-15969) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1885885 - CVE-2020-15969 chromium-browser: Use after free in WebRTC 1889932 - CVE-2020-15683 Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: firefox-78.4.0-1.el7_9.src.rpm x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: firefox-78.4.0-1.el7_9.i686.rpm Red Hat Enterprise Linux Server (v. 7): Source: firefox-78.4.0-1.el7_9.src.rpm ppc64: firefox-78.4.0-1.el7_9.ppc64.rpm firefox-debuginfo-78.4.0-1.el7_9.ppc64.rpm ppc64le: firefox-78.4.0-1.el7_9.ppc64le.rpm firefox-debuginfo-78.4.0-1.el7_9.ppc64le.rpm s390x: firefox-78.4.0-1.el7_9.s390x.rpm firefox-debuginfo-78.4.0-1.el7_9.s390x.rpm x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): x86_64: firefox-78.4.0-1.el7_9.i686.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: firefox-78.4.0-1.el7_9.src.rpm x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: firefox-78.4.0-1.el7_9.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-15683 https://access.redhat.com/security/cve/CVE-2020-15969 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX5G+ntzjgjWX9erEAQhmDQ//dHDny/ImuLP8xvK4PtLEY7BRvrOS/vY2 YkKEGdGOQa48sBw+5Y2tSqra5gKOqf5H3lcxj+sTG97hUStgrNAucZpTHaKm7vde /Eb3PIFWOqnNpcvDg6njU/q5ttA7YC0PHizRfH0Yix5EUAkKZnMWlcS8Lkm5FEM2 Ws+UfvgB/+Gx03I2MioDwnnHnnZLR+pmt7EYl7CnKLRMYsQVEkrlc2b7gCzPlijo UV91wcUoX4s9/v/i2afTY8CqhDs8MNHFnsVX+FTCyGbezamAxJ+YTKtDgKDiG+7v up2fIlMhf8eKnkEpyOebDDPo8vECJr311rXT0qg6/jkx9iogOyHskOcmTYIK5xzT R9gmF+gvsJsMeHzD6a6uh5BsLLS7rtIESWO91IS0FofOAv0lkkOqG1xlAq4zAKYc 8NrzZ0omzrB9rRK2LeKp2oAP0xIoFQiTmicoBAvRijNPRSWT8SZY/IfOsSvrbfkG rGOY4nNaLVQUqXv7+BKa/LusfBhQkGgxcKO/uNX7xWGTEqH4ysx7/ELKmQ1LjZxw bgYhrYaSkSMAQ5r/Nf0qMHLLxvMUqmJmgkExE0rLwogxWVYZWVCiIwI0wncDCFEo mw8HZ58JlTWTv2owGc8I0fo+ln7Y5xmuXuyN6AldueladP0AdtdNyaw/GHquCytW o2ukWK2zUE8=oczW -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software. PendingIntent allows sdcard access by an unprivileged process. The Samsung ID is SVE-2020-18392 (October 2020). This vulnerability is Samsung ID: SVE-2020-18392 It is published as.Information may be obtained. are all products of South Korean Samsung (Samsung). Samsung mobile devices O (8.1), P (9.0), Q (10.0) and R (11.0) have security vulnerabilities, which stem from a problem with EthernetNetwork. No detailed vulnerability details are currently provided

An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. PendingIntent allows an unprivileged process to access contact numbers. The Samsung ID is SVE-2020-18467 (October 2020). This vulnerability is Samsung ID: SVE-2020-18467 It is published as.Information may be obtained. are all products of South Korean Samsung (Samsung). The vulnerability originates in SystemUI

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Sticker Center allows directory traversal for an unprivileged process to read arbitrary files. The Samsung ID is SVE-2020-18433 (October 2020). This vulnerability is Samsung ID: SVE-2020-18433 It is published as.Information may be obtained. are all products of South Korean Samsung (Samsung)

An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingIntent with an empty intent is mishandled, allowing an attacker to perform a privileged action via a modified intent. The Samsung ID is SVE-2020-18418 (October 2020). This vulnerability is Samsung ID: SVE-2020-18418 It is published as.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. are all products of South Korean Samsung (Samsung). The vulnerability originates from TimaService

An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attackers to obtain sensitive information by reading a log. The Samsung ID is SVE-2020-18596 (October 2020). Samsung Mobile devices contain a vulnerability related to information leakage from log files. This vulnerability is Samsung ID: SVE-2020-18596 It is published as.Information may be obtained

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. An attacker can access certain Secure Folder content via a debugging command. The Samsung ID is SVE-2020-18673 (October 2020). This vulnerability is Samsung ID: SVE-2020-18673 It is published as.Information may be obtained. are all products of South Korean Samsung (Samsung). Samsung mobile devices O (8.x), P (9.0), Q (10.0) and R (11.0) have security vulnerabilities

An issue was discovered on Samsung mobile devices with Q(10.0) software. The DynamicLockscreen Terms and Conditions can be accepted without authentication. The Samsung ID is SVE-2020-17079 (October 2020). This vulnerability is Samsung ID: SVE-2020-17079 It is published as.Information may be tampered with. Samsung mobile devices Q is a TV series of Samsung (Samsung) in South Korea. No detailed vulnerability details are currently provided

D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping (aka res_config_action=3&res_config_id=18). D-Link DAP-1360U A command injection vulnerability exists in the device.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. D-Link DAP-136 is a wireless network signal extender. D-Link DAP-136 has security vulnerabilities in processing IP parameters, allowing remote attackers to use the vulnerabilities to submit special requests and execute arbitrary commands in the context of the application

An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingIntent with an empty intent is mishandled, allowing an attacker to perform a privileged action via a modified intent. The Samsung ID is SVE-2020-18034 (October 2020). This vulnerability is Samsung ID: SVE-2020-18034 It is published as.Information may be tampered with. are all products of South Korean Samsung (Samsung). Samsung mobile devices O (8.x), P (9.0) and Q (10.0) have security vulnerabilities, which can be exploited by attackers to perform privileged operations by modifying intent