[FD] Asset Explorer (Windows & Linux) - Authenticated Command Execution

- - All versions prior to 6.5 (6503) Credit - Sahil Dhar - xen1thLabs - Software Labs Vulnerability summary - ManageEngine Asset Explorer application does not validate System Center Configura

[FD] Asset Explorer Windows Agent - Remote Code Execution

redit - Sahil Dhar - xen1thLabs - Software Labs Vulnerability summary - It was observed that, while upgrading the Asset Explorer's windows agent, it does not validate the source IP address of server sending t

[FD] DataSecurity Plus Xnode Server - Authentication Bypass

(6032) Credit - Sahil Dhar - xen1thLabs - Software Labs Vulnerability summary - ManageEngine DataSecurity Plus application uses default admin credentials to communicate with Dataengine Xnode

[FD] DataSecurity Plus Xnode Server - Remote Code Execution via Path Traversal

prior to 6.0.3 (6032) Credit - Sahil Dhar - xen1thLabs - Software Labs Vulnerability summary - ManageEngine DataSecurity Plus's DataEngine Xnode Server application does not validat

[FD] Two vulnerabilities found in Sony BRAVIA Smart TVs

## ADVISORY INFORMATION TITLE: Two vulnerabilities found in Sony BRAVIA Smart TVs ADVISORY URL: CVE-2019-11889 https://www.darkmatter.ae/xen1thlabs/sony-remote-denial-of-service-triggered-over-vulnerability-hbbtv-xl-19-014/ CVE-2019-11890 https

[FD] XL-19-012 - ABB IDAL HTTP Server Uncontrolled Format String Vulnerability

--- ABB (new.abb.com) Credit -- Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The IDAL HTTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to

[FD] XL-19-011 - ABB IDAL HTTP Server Stack-Based Buffer Overflow Vulnerability

vendor --- ABB (new.abb.com) Credit -- Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The IDAL HTTP server is vulnerable to a stack-based buffer overflow when receiving a large host header in a HTTP request. The host header value overflows a

[FD] XL-19-010 - ABB IDAL HTTP Server Authentication Bypass Vulnerability

--- ABB (new.abb.com) Credit -- Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions

[FD] XL-19-009 - ABB HMI Hardcoded Credentials Vulnerability

/A:H) Affected vendor --- ABB (new.abb.com) Credit -- xen1thLabs - Software Labs Vulnerability summary - The affected ABB components implement hidden administrative accounts used during the provisioning phase of the HMI interface. These credentials allow the

[FD] XL-19-008 - ABB IDAL FTP Server Path Traversal Vulnerability

--- ABB (new.abb.com) Credit -- Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The IDAL FTP server fails to ensure that directory change requests do not change to locations outside of the FTP servers root directory. An authenticated attacker can

[FD] XL-19-006 - ABB HMI Outdated Software Components

(new.abb.com) Credit -- xen1thLabs - Software Labs Vulnerability summary - ABB HMI uses outdated software components that are statically linked into the firmware files and service binaries. These components have documented vulnerabilities and should be updated and

[FD] XL-19-007 - ABB IDAL FTP Server Buffer Overflow Vulnerability

--- ABB (new.abb.com) Credit -- Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The IDAL FTP server is vulnerable to a buffer overflow where a large string is sent by an authenticated attacker that causes a buffer overflow. This overflow is handled

[FD] XL-19-005 - ABB HMI Absence of Signature Verification Vulnerability

) Affected vendor --- ABB (new.abb.com) Credit -- xen1thLabs - Software Labs Vulnerability summary - ABB HMI uses two different transmission methods to upgrade its software components: - Utilization of USB/SD Card to flash the device - Remote provisioning

[FD] XL-19-004 - ABB IDAL FTP Server Uncontrolled Format String Vulnerability

--- ABB (new.abb.com) Credit -- Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The IDAL FTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to

[FD] Multiple vulnerabilities in Sony Smart TVs

a Wi-Fi access point and shows a Wi-Fi password allowing customers to connect and share their media content on the Sony Smart TVs. ## DETAILS OF VULNERABILITIES xen1thLabs has found multiple vulnerabilities in Sony products in October 2018 and xen1thLabs coordinated the disclosure of these vulne