Kevin Finisterre

Multiple Unitree robotic products sharing a common firmware contain a command injection issue. An attacker can inject a malicious string during WiFi configuration via a BLE module, and then trigger a restart of the WiFi service. This allows the attacker to execute commands as root through the `wpa supplicant restart.sh` shell script. The vulnerability affects devices using firmware derived from the MIT Cheetah codebase, including the G1 (humanoid) and Go2 (quadruped) branches.

The issue concerns an undocumented backdoor in the robotic device. This backdoor allows the manufacturer and anyone with the correct API key to gain complete remote control over the device using the CloudSail remote access service.

The issue concerns DJI drone devices broadcasting unencrypted information about the drone operator's physical location via the AeroScope protocol.

The issue allows remote attackers to obtain management access without requiring authentication for commands. This can be achieved by sending a crafted query, such as a V52 query, which can trigger actions like powering off the device.

The issue concerns multiple buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved via the User-Agent HTTP header to hserver.dll or through unspecified input to hagent.exe.

The issue allows remote attackers to obtain administrative control over client machines by discovering a shared secret used for authentication. This is possible because the secret is transmitted in cleartext, making it easier for attackers to sniff the network and discover the secret value.

A buffer overflow issue in the tm-console-bin component of the DevonIT thin-client management tool may allow remote attackers to execute arbitrary code. The specific vectors used for the attack are not specified.

A buffer overflow issue allows remote attackers to cause a denial of service, potentially leading to a crash, and possibly execute arbitrary code via a long string to the LPD service.

The issue allows local users to gain privileges through vectors related to the use of wheel group membership during access to user account home directories.

The issue is a stack-based buffer overflow in the `HsbParser.getSoundBank` function. This allows remote attackers to execute arbitrary code via a long file: URL in an argument.

The issue is a stack-based buffer overflow in the ODBC server service, which allows remote attackers to execute arbitrary code. This can be achieved by sending a long string in the second application packet in a TCP session on port 20222.

The issue involves an insecure file operation in Spin Tracer, allowing local users to execute arbitrary code via unspecified output files.

The issue allows remote authenticated users to potentially execute arbitrary code or cause a denial of service, resulting in a daemon crash. This is achieved by creating a stored procedure with a long name and then invoking this procedure, which triggers heap corruption.

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to certain stored procedures, including (1) AsciiBackup and (2) OEMLicenseInstall, and possibly others.

The issue allows local users to change permissions of arbitrary files via a symlink attack on /Library/Application Support/Virex/VShieldExclude.txt. This can be exploited to execute arbitrary commands, for example, by symlinking to the root crontab file.

Name of the Vulnerable Software and Affected Versions: Mac OS X versions 10.4.11 and earlier Description: A buffer overflow issue exists in the Apple Minimal SLP v2 Service Agent (slpd) that allows local users, and possibly remote attackers, to gain privileges and possibly execute arbitrary code via a registration request with an invalid `attr-list` field. Recommendations: For Mac OS X versions 10.4.11 and earlier, update to a version later than 10.4.11 to resolve the issue.

The issue allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.

A buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a long `rtsp://` URI. The `rtsp://` handler fails to validate a supplied URL string, resulting in a stack overflow. With a specially crafted URL, an attacker can cause arbitrary code execution, leading to a loss of integrity.

The issue is related to a buffer overflow in the glob implementation, which can be exploited by remote authenticated users to execute arbitrary code. This is achieved by providing a long pathname that results from path expansion, affecting the FTP daemon and tnftpd.

The issue is related to an untrusted search path vulnerability in WSAdminServer and WSWebServer components. This vulnerability allows local users with webstar privileges to gain root privileges by utilizing a malicious libucache.dylib helper library in the current working directory.