4363 matches found
CVE-2017-16882: Incorrect Permission Assignment for Critical Resource
Icinga Core through 1.14.0 initially executes bin/icinga as root but supports configuration options in which this file is owned by a non-root account and similarly can have etc/icinga.cfg owned by a non-root account, which allows local users to gain privileges by leveraging access to this non-roo...
PT-2017-14617
Name of the Vulnerable Software and Affected Versions Icinga Core versions prior to 1.14.0 Icinga Core through 1.14.0 Description The issue allows local users to gain privileges by leveraging access to a non-root account. This is related to the execution of bin/icinga as root and the support of...
PT-2017-14584
Name of the Vulnerable Software and Affected Versions PNP4Nagios versions prior to 0.6.27 Description The issue allows local users to gain privileges by leveraging access to an unprivileged account, as /usr/bin/npcd and npcd.cfg are owned by this account but are used for root code execution...
radare2 denial of service vulnerability (CNVD-2017-36110)
radare2 is a set of libraries and tools for working with binary files. A security vulnerability exists in the libr/bin/dwarf.c file in radare2 version 2.0.1. A remote attacker can exploit this vulnerability to cause a denial of service invalid read and application crash with the help of a special...
Design/Logic Flaw
In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service invalid read and application crash via a crafted ELF file, related to rbindwarfparsecompunit in dwarf.c and sdbsetinternal in shlr/sdb/src/sdb.c...
CVE-2017-16805
In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service invalid read and application crash via a crafted ELF file, related to rbindwarfparsecompunit in dwarf.c and sdbsetinternal in shlr/sdb/src/sdb.c...
CVE-2017-16805
In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service invalid read and application crash via a crafted ELF file, related to rbindwarfparsecompunit in dwarf.c and sdbsetinternal in shlr/sdb/src/sdb.c...
Linux/x64 - Reverse TCP (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (1234567) Shellcode (104 bytes)
Linux/x64 - Reverse TCP 127.0.0.1:4444/TCP Shell /bin/sh + Password 1234567 Shellcode 104 bytes. Shellcode exploit for Linuxx86-64 platform global start start: ; sock = socketAFINET, SOCKSTREAM, 0 ; AFINET = 2 ; SOCKSTREAM = 1 ; syscall number 41 push 41 pop rax push 2 pop rdi push 1 pop rsi cdq...
Cross site scripting
XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...
CVE-2017-16765
XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...
CVE-2017-16765
XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...
CVE-2017-16765
Affected product: D-Link DWR-933 portable wireless router (firmware version 1.00(WW)B17). Vulnerable component: the web management interface CGI, specifically cgi-bin/gui.cgi. Issue: cross-site scripting (XSS) vulnerability described as XSS exists on the DWR-933 via the GUI CGI. Root cause: not e...
CVE-2017-16765: Improper Neutralization of Input During Web Page Generation
XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...
PT-2017-14547
Name of the Vulnerable Software and Affected Versions D-Link DWR-933 version 1.00WWB17 Description A cross-site scripting XSS issue exists, allowing potential exploitation via the "cgi-bin/gui.cgi" API endpoint. Recommendations For D-Link DWR-933 version 1.00WWB17, consider restricting access to...
petcabaret.com XSS vulnerability
Open Bug Bounty ID: OBB-401689 Description| Value ---|--- Affected Website:| petcabaret.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...
Citrix Provisioned Target Fails To PXE Boot With Infoblox DHCP
When trying to PXE boot provisioning service target Virtual machines, it was failing with the following error Could not start download: operation not supported' Target Virtual Machine able to receive the DHCP IP from Infoblox Appliancebut not able to download ARDBP32.bin from the TFTP server...
CVE-2017-16564
Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...