Blog | Jeremy Murtishaw, Inc.

CVE-2016-5054

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.

CVE-2016-5053

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.

CVE-2016-5076

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.

CVE-2016-5075

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

CloudView NMS before 2.10a has XSS via a TELNET login.

CVE-2016-5057

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.

CVE-2016-5055

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.

CVE-2016-5056

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.

CVE-2016-5065

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.

CVE-2016-5058

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.

CVE-2016-5059

by JeremySecurity Bulletins April 10, 2017Comments are Disabled

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application.