CVE-2019-18842

A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...

CVE-2019-18842

CVE-2019-18842 concerns the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module (web interface version 1.2.2). Multiple connected sources confirm a Cross‑Site Scripting (XSS) vulnerability in the configuration web interface caused by insufficient input validation, enabling an attacker to exf...

CVE-2019-18842: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...

PT-2019-6904

Name of the Vulnerable Software and Affected Versions NETGEAR Centria WNDR4700 Firmware version 1.0.0.34 Description An Authentication Bypass issue exists, allowing any user to access the web administration portal without a password by visiting a specific URL. The affected URL is...

CVE-2019-14925: Incorrect Default Permissions

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames,...

CVE-2019-17120

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/admusrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after...

PT-2019-14958

Name of the Vulnerable Software and Affected Versions WiKID 2FA Enterprise Server versions through 4.2.0-b2047 Description A stored and reflected cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the "/WiKIDAdmin/adm usrs.jsp" API endpoint. The usr...

CVE-2019-17120: Improper Neutralization of Input During Web Page Generation

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/admusrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after...

Solaris xscreensaver 11.4 - Privilege Escalation

Solaris xscreensaver 11.4 - Privilege Escalation Exploit Title: Solaris xscreensaver 11.4 - Privilege Escalation Date: 2019-10-16 Exploit Author: Marco Ivaldi Vendor Homepage: https://www.oracle.com/technetwork/server-storage/solaris11/ Version: Solaris 11.x Tested on: Solaris 11.4 and 11.3 X86...

CVE-2019-15119

lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user...

Default credentials

A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/mipsca.db. If a camera is compromised, the attacker can gain access to passwords and abuse them to compromise further systems...

CVE-2019-1552: Improper Certificate Validation

OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versio...

PT-2019-13314

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns an incomplete factory-reset process implemented by /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on the affected device. This incompleteness c...

CVE-2019-5443

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

CVE-2019-5443: Improper Control of Generation of Code

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

PT-2019-12938

Name of the Vulnerable Software and Affected Versions ENTTEC Datagate MK2 version 70044 update 05032019-482 ENTTEC Storm 24 version 70044 update 05032019-482 ENTTEC Pixelator version 70044 update 05032019-482 ENTTEC E-Streamer MK2 version 70044 update 05032019-482 Description An issue was...

CVE-2019-12777: Incorrect Permission Assignment for Critical Resource

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They replace secure and protected directory permissions set as default by the underlying operating system with highly insecure read, write, and execute directory...

CVE-2018-13291: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration...

CVE-2018-13292: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager SRM before 1.1.7-6941-2 allows remote authenticated users to obtain sensitive information via the world readable configuration...

CVE-2018-20218: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter...