You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on May 14, 2024. It is now read-only.
"Description": "Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability (CWE-79) in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert JavaScript into this note field that is then saved and displayed to the end user.",
40
+
"ID": "VU#756913",
41
+
"IDNumber": "756913",
42
+
"IPProtocol": "",
43
+
"Impact": "An authenticated attacker might include JavaScript that could execute on an authenticated user's system, which could lead to website redirects, session cookie hijacking, social engineering, and other impacts. Since the attacker's script is stored with the information about the node, all other users with access to this data are also vulnerable.",
44
+
"Keywords": [
45
+
"Pixar",
46
+
"Tractor",
47
+
"rendering software",
48
+
"stored XSS",
49
+
"CVE-2018-5411"
50
+
],
51
+
"Overview": "Pixar's Tractor network rendering software is vulnerable to stored cross-site scripting which may allow an attacker to execute arbitrary JavaScript.",
52
+
"References": [
53
+
"https://cwe.mitre.org/data/definitions/79.html",
54
+
"https://renderman.pixar.com/product/tractor"
55
+
],
56
+
"Resolution": "Apply an update\nPixar has released an updated version of this software that addresses this vulnerability, Tractor version 2.3 (build 1923604). Affected users should update to this version.",
57
+
"Revision": 55,
58
+
"SystemsAffectedPreamble": "",
59
+
"ThanksAndCredit": "Thanks to the reporter who wishes to remain anonymous.",
60
+
"Title": "Pixar Tractor contains a stored cross-site scripting vulnerability",
"VendorInformation": "MyCar is one of AutoMobility Distribution's brands.",
11
+
"VendorRecordID": "TNOY-BADKZB",
12
+
"VendorReferences": "https://mycarcontrols.com/",
13
+
"VendorStatement": "On behalf of the ownership of MyCar Controls, We have been made aware of a vulnerability issue in our systems late in January 2019. Since then, all the resources at our disposal have been used to promptly address the situation, and we have fully resolved the issue. During this vulnerability period, no actual incident or issue with compromised privacy or functionality has been reported to us or detected by our systems. Rest assured, the entire organization is focused on making our product the most secure and versatile product in the remote starter industry. Passion, hard work and accountability will always be the hallmarks of our organization. We thank you for your understanding and continued support. The AutoMobility Management Team"
"Description": "MyCar is a small aftermarket telematics unit from AutoMobility Distribution Inc. MyCar add smartphone-controlled geolocation, remote start/stop and lock/unlock capabilities to a vehicle with a compatible remote start unit. The MyCar Controls mobile application contains hard-coded admin credentials (CWE-798) which can be used in place of a user's username and password to communicate with the server endpoint for a target user's account. This vulnerability affects versions prior to 3.4.24 on iOS and prior to 4.1.2 on Android.",
40
+
"ID": "VU#174715",
41
+
"IDNumber": "174715",
42
+
"IPProtocol": "",
43
+
"Impact": "A remote un-authenticated attacker may be able to send commands to and retrieve data from a target MyCar unit. This may allow the attacker to learn the location of a target, or gain unauthorized physical access to a vehicle.",
44
+
"Keywords": "IoT",
45
+
"Overview": "The MyCar Controls mobile applications prior to v3.4.24 on iOS and prior to v4.1.2 on Android contains hard-coded admin credentials.",
"Resolution": "Update Phone App\nAutoMobility has updated their mobile apps to remove the hard coded credentials. On iOS the updated version is v3.4.24, and on Android the updated version is v4.1.2. Additionally the admin credentials in old versions of the mobile application have been revoked.",
53
+
"Revision": 19,
54
+
"SystemsAffectedPreamble": "The MyCar unit and corresponding mobile application may be rebranded and sold by other vendors as something other than MyCar. Other brands include: Carlink\nLinkr\nVisions MyCar\nMyCar Kia\nThese brands have also been updated.",
55
+
"ThanksAndCredit": "Thanks to Jmaxxz for reporting this vulnerability.",
0 commit comments