3x Reflected XSS vectors for services.cgi (XM.v6.1.6, build 32290) #331368 Valid Cross-site Scripting Medium 2021-10-10 – 2 Weak credentials for nutty.ubnt.com #204052 Informative Authentication Medium 2017-03-29 – 4 Local File Disclosure (+XSS+CSRF) in AirOS 6.2.0 devices #661647 Valid Command and Code Injection Medium 2020-06-30 – 6 XSS on Nanostation Loco M2 Airmax #158287 Valid Cross-site Scripting Medium 2017-10-02 – 8 CRLF Injection on openvpn.svc.ubnt.com #232327 Valid Injection and Smuggling Medium 2017-07-04 – 8 Reflected cross-site scripting (XSS) vulnerability in scores.ubnt.com allows attackers to inject arbitrary web script via p parameter. #208622 Valid Cross-site Scripting Medium 2017-04-07 – 9 XSS via SVG file #212253 Duplicate Cross-site Scripting Medium 2017-05-01 – 9 UniFi Video v3.10.1 (Windows) Local Privileges Escalation to SYSTEM from arbitrary filedelete and DLL hijack vulnerabilities. #530967 Valid Access Control Medium 2020-04-01 – 9 Reflected XSS in Nanostation Loco M2 - AirOS ver=6.1.7 #386570 Valid Cross-site Scripting Medium 2020-06-01 – 10 Unauthenticated request allows changing hostname #802079 Valid Authentication Medium 2020-04-10 – 10 XW 6.2.0 firmware: 5 Reflected XSS issues in link.cgi #802498 Valid Cross-site Scripting Medium 2021-10-10 – 10 Subdomain takeover on https://cloudfront.ubnt.com/ due to non-used CloudFront DNS entry #210188 Valid Authentication Medium 2017-05-07 – 12 [dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies #219014 Valid Information Disclosure Medium 2017-08-28 – 12 Bypass blocked profile protection on aircrm.ubnt.com #332631 Valid Access Control Medium 2018-07-03 – 13 EdgeSwitch Command Injection #508256 Valid Command and Code Injection Medium 2019-03-31 – 15 [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html #200753 Valid Cross-site Scripting Medium 2017-03-30 – 17 Wordpress directories/files visible to internet #201984 Valid Information Disclosure Medium 2017-03-08 – 18 Two Factor Authentication Bypass #350288 Valid Authentication Medium 2018-07-16 – 18 [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users #197958 Valid Command and Code Injection Medium 2017-07-21 – 27 Login as root without password on EdgeSwitchX Analysed #512958 Valid Authentication Medium 2019-03-31 – 56