CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-44530
https://notcve.org/view.php?id=CVE-2021-44530
An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to control the application. Se presenta una vulnerabilidad de inyección en una biblioteca de terceros usada en UniFi Network versiones 6.5.53 y anteriores (Log4J CVE-2021-44228) que permite a un actor malicioso controlar la aplicación • https://community.ui.com/releases/Security-Advisory-Bulletin-023-023/808a1db0-5f8e-4b91-9097-9822f3f90207 • CWE-20: Improper Input Validation CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22882
https://notcve.org/view.php?id=CVE-2021-22882
UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash. UniFi Protect versiones anteriores a v1.17.1, permite a un atacante usar cámaras falsificadas para llevar a cabo un ataque de denegación de servicio que puede causar que el controlador UniFi Protect se bloquee • https://community.ui.com/releases/Security-advisory-bulletin-017-017/071141e5-bc2e-4b71-81f3-5e499316fcee https://hackerone.com/reports/1008579 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-27888
https://notcve.org/view.php?id=CVE-2020-27888
An issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi Controller 6.0.28 devices. Cached credentials are not erased from an access point returning wirelessly from a disconnected state. This may provide unintended network access. Se detectó un problema en los dispositivos Ubiquiti UniFi Meshing Access Point UAP-AC-M versión 4.3.21.11325 y UniFi Controller versión 6.0.28. Las credenciales almacenadas en caché no son borradas de un punto de acceso que retorna de forma inalámbrica desde un estado desconectado. • https://community.ui.com/questions/Possible-authentication-bypass-for-access-into-LAN/7965adb2-5d70-4410-8467-4c7bec76bc00 • CWE-459: Incomplete Cleanup CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 220EXPL: 1CVE-2020-12695 – hostapd: UPnP SUBSCRIBE misbehavior in WPS AP
https://notcve.org/view.php?id=CVE-2020-12695
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. La especificación UPnP de Open Connectivity Foundation antes del 17-04-2020 no prohíbe la aceptación de una petición de suscripción con una URL de entrega en un segmento de red diferente a la URL de suscripción de evento totalmente calificada, también se conoce como el problema de CallStranger • https://github.com/yunuscadirci/CallStranger http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html http://www.openwall.com/lists/oss-security/2020/06/08/2 https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek https://github.com/corelight/callstranger-detector https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html https://lists.debian.org/debian-l • CWE-276: Incorrect Default Permissions CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15595
https://notcve.org/view.php?id=CVE-2019-15595
A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands. Se presenta una escalada de privilegios en UniFi Video Controller versiones anteriores a 3.10.6 incluyéndola, que permitiría a un atacante en la máquina local ejecutar comandos arbitrarios. • https://hackerone.com/reports/544928 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •