a657b64301
7 changes to exploits/shellcodes macOS/iOS - JavaScript Injection Bug in OfficeImporter Linux/Ubuntu - Other Users coredumps can be read via setgid Directory and killpriv Bypass Microsoft Enterprise Mode Site List Manager - XML External Entity Injection Hadoop YARN ResourceManager - Unauthenticated Command Execution (Metasploit) Hadoop YARN ResourceManager - Command Execution (Metasploit) VelotiSmart WiFi B-380 Camera - Directory Traversal Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection WordPress Plugin Job Manager 4.1.0 - Cross-Site Scripting Linux/ARM - Bind (1234/TCP) Shell (/bin/sh) Shellcode (104 bytes)
22 lines
No EOL
667 B
Text
22 lines
No EOL
667 B
Text
Title: Vulnerability in VelotiSmart Wifi - Directory Traversal
|
||
Date: 12-07-2018
|
||
Scope: Directory Traversal
|
||
Platforms: Unix
|
||
Author: Miguel Mendez Z
|
||
Vendor: VelotiSmart
|
||
Version: B380
|
||
CVE: CVE-2018–14064
|
||
|
||
|
||
Vulnerability description
|
||
-------------------------
|
||
- The vulnerability that affects the device is LFI type in the uc-http service 1.0.0. What allows to obtain information of configurations, wireless scanned networks, sensitive directories, etc. Of the device.
|
||
|
||
Vulnerable variable:
|
||
http://domain:80/../../etc/passwd
|
||
|
||
Exploit link:
|
||
https://github.com/s1kr10s/ExploitVelotiSmart
|
||
|
||
Poc:
|
||
https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac |