2498 matches found
CVE-2017-14117
The CVE-2017-14117 vulnerability affects AT&T U-verse firmware 9.2.2h0d83 on Arris NVG589/NVG599 when IP Passthrough is not used. It configures an unauthenticated proxy service on WAN TCP port 49152, allowing remote attackers to establish arbitrary TCP connections to intranet hosts by sending the...
CVE-2017-14116
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 an...
CVE-2017-10793
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...
CVE-2017-14115: Use of Hard-coded Credentials
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and...
CVE-2017-14116: Use of Hard-coded Credentials
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 an...
CVE-2017-10793: Exposure of Sensitive Information to an Unauthorized Actor
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...
AT&T U-verse Arris Modems NVG589 / NVG599 / 5268AC Multiple Vulnerabilities (SharknATTo)
The remote Arris device's self report model is NVG589, NVG599 or 5268AC. It is, therefor, affected by multiple vulnerabilities, including a firewall bypass, multiple instances of hardcoded credentials, privilege escalation, and remote code execution. Note: Nessus has not checked the firmware...
Bugs in Arris Modems Distributed by AT&T Vulnerable to Trivial Attacks
Trivially exploitable vulnerabilities have been discovered in several Arris home modems, routers and gateways distributed to consumers and small businesses through AT&T’s U-verse service. It’s unknown yet whether the firmware vulnerabilities were introduced by the OEM or the ISP since AT&T seems ...
Open WAN-to-LAN proxy on AT&T routers
The Arris NVG589 and NVG599 routers configured with AT&T U-verse firmware 9.2.2h0d83 expose an un-authenticated proxy that allows connecting from WAN to LAN by MAC address. Module Options msf use auxiliary/scanner/wproxy/att/openproxy msf undefinedopenproxy show actions ...actions... msf...
SQL injection vulnerability in gsjj.php page t parameter of Olekai website builder system
Olekai website builder is a website editing, designing and other website building system. There is a SQL injection vulnerability in the t parameter in the gsjj.php page of the Olekai website builder system, which can be exploited by an attacker to obtain sensitive information from the database...
Hack with Metasploit: Announcing the UNITED 2017 CTF
Got mad skillz? Want mad skillz? This year at Rapid7s annual UNITED Summit, were hosting a first-of-its-kind Capture the Flag CTF competition. Whether youre a noob to hacking or a grizzled pro, youll emerge from our 25-hour CTF with more knowledge and serious bragging rights. Show off your 1337...
Multiple Reflective Cross-Site Scripting Vulnerabilities in Treehole Outbound Linking System
Treehole external chain system is a free and open source PHP external chain network disk system, support for seven cattle, local, remote three kinds of storage methods, support for multi-user system. TreeHole Outbound Linking System '\content\common\vplayer.php' and '\views\error.php' files have...
Red-Gate SQL Monitor 3.10 4.2 - Authentication Bypass
Red-Gate SQL Monitor 3.10 4.2 - Authentication Bypass Exploit Title: Red-Gate SQL Monitor authentication bypass Version: Redgate SQL Monitor before 3.10 and 4.x before 4.2 Date: 2017-08-10 Red-Gate made a security announcement and publicly released the fixed version more than two years before thi...
t-coffee ~/.t_coffee out-of-bounds write vulnerability
t-coffee is a multiple alignment tool for calculating and evaluating the sequence and structure of DNA, RNA and proteins. A security vulnerability exists in versions prior to t-coffee 11.00.8cbe486-2. A local attacker could exploit the vulnerability to write to a file...
CVE-2015-8621
t-coffee before 11.00.8cbe486-2 allows local users to write to /.tcoffee globally...
CVE-2015-8621
t-coffee before 11.00.8cbe486-2 allows local users to write to /.tcoffee globally...
Code injection
t-coffee before 11.00.8cbe486-2 allows local users to write to /.tcoffee globally...
DEBIAN-CVE-2015-8621
t-coffee before 11.00.8cbe486-2 allows local users to write to /.tcoffee globally...