|
267021
|
7.8 |
HIGH
Local
|
nutspace
|
nut_mobile
|
The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.
|
CWE-255 CWE-200
Credentials Management Information Exposure
|
CVE-2016-6547
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267022
|
7.8 |
HIGH
Local
|
kkmcn
|
itrackeasy
|
The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cl…
|
CWE-255 CWE-200
Credentials Management Information Exposure
|
CVE-2016-6546
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267023
|
9.8 |
CRITICAL
Network
|
ieasytec
|
itrackeasy
|
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this …
|
CWE-384
Session Fixation
|
CVE-2016-6545
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267024
|
7.5 |
HIGH
Network
|
ieasytec
|
itrack_easy
|
getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerability can be exploited to alter the GPS data of a lost device.
|
CWE-287
Improper Authentication
|
CVE-2016-6544
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267025
|
5.9 |
MEDIUM
Network
|
ieasytec
|
itrack_easy
|
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device.
|
CWE-284
Improper Access Control
|
CVE-2016-6543
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267026
|
3.7 |
LOW
Network
|
ieasytec
|
itrackeasy
|
The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address.
|
CWE-20
Improper Input Validation
|
CVE-2016-6542
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267027
|
9.8 |
CRITICAL
Network
|
shdesigns
|
resident_download_manager
|
SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some industrial control and embedded applica…
|
CWE-20
Improper Input Validation
|
CVE-2016-6567
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267028
|
8.1 |
HIGH
Network
|
infinixauthority bluproducts xolo beeline iku-mobile leagoo doogee
|
hot_x507_firmware hot_2_x510_firmware zero_x506_firmware zero_2_x509_firmware studio_g_firmware studio_g_plus_firmware studio_6.0_hd_firmware studio_x_firmware studio_x_plus_f…
|
Android devices with code from Ragentek contain a privileged binary that performs over-the-air (OTA) update checks. Additionally, there are multiple techniques used to hide the execution of this bina…
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2016-6564
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267029
|
9.8 |
CRITICAL
Network
|
dlink
|
dir-823_firmware dir-822_firmware dir-818l\(w\)_firmware dir-895l_firmware dir-890l_firmware dir-885l_firmware dir-880l_firmware dir-868l_firmware dir-850l_firmware
|
Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, …
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2016-6563
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
267030
|
9.8 |
CRITICAL
Network
|
freebsd
|
freebsd
|
Improper bounds checking of the obuf variable in the link_ntoa() function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depend…
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2016-6559
|
2024-11-21 11:56 |
2018-07-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|