Cisco Data Center Network Manager Unauthenticated Remote Code Execution Exploit

DCNM exposes a file upload servlet FileUploadServlet at /fm/fileUpload. An authenticated user can abuse this servlet to upload a WAR to the Apache Tomcat webapps directory and achieve remote code execution as root. This module exploits two other vulnerabilities, CVE-2019-1619 for authentication...

Cisco Data Center Network Manager Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco Data Center Network Manager Unauthenticated Remote Code Execution', 'Description' = %q DCNM exposes a file upload servlet FileUploadServlet...

Cisco Data Center Network Manager Unauthenticated Remote Code Execution

DCNM exposes a file upload servlet FileUploadServlet at /fm/fileUpload. An authenticated user can abuse this servlet to upload a WAR to the Apache Tomcat webapps directory and achieve remote code execution as root. This module exploits two other vulnerabilities, CVE-2019-1619 for authentication...

CVE-2019-1622

CVE-2019-1622 describes an information-disclosure vulnerability in Cisco Data Center Network Manager (DCNM). The issue arises in the web-based management interface due to improper access control for certain URLs, allowing an unauthenticated, remote attacker to request specific URLs and potentiall...

CVE-2019-1622 Cisco Data Center Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

1622.nl XSS vulnerability

Open Bug Bounty ID: OBB-708422 Description| Value ---|--- Affected Website:| 1622.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

CVE-2017-1622

creationtimestamp| type| source ---|---|--- 2018-12-05 20:27:04+00:00| seen| https://t.me/cibsecurity/1507...

CVE-2017-1622

CVE-2017-1622 affects IBM QRadar SIEM 7.2.x (7.2.0 to 7.2.8 Patch 13) and 7.3.x (7.3.0 to 7.3.1 Patch 6/7). The root cause is improper certificate validation in the QRadar Application Framework, allowing a MITM attacker to spoof a trusted entity. Affected component/file relates to certificate val...

CVE-2012-1622

CVE-2012-1622 affects Apache OFBiz 10.04.x before 10.04.02 and allows remote attackers to execute arbitrary code via unspecified vectors. The vulnerability is described as a remote code execution issue with high impact (network access, no auth required; exploits possible without user interaction)...

[SECURITY] [DSA 3486-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3486-1 [email protected] https://www.debian.org/security/ Michael Gilbert February 21, 2016 https://www.debian.org/security/faq -...

openSUSE Security Update : Chromium (openSUSE-2016-221)

This update to Chromium 48.0.2564.109 fixes the following issues : Security fixes boo965999 : - CVE-2016-1622: Same-origin bypass in Extensions - CVE-2016-1623: Same-origin bypass in DOM - CVE-2016-1624: Buffer overflow in Brotli - CVE-2016-1625: Navigation bypass in Chrome Instant - CVE-2016-162...

Important: Red Hat Security Advisory: chromium-browser security update

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severit...

RHEL 6 : chromium-browser (RHSA-2016:0241)

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severit...

CVE-2016-1622

CVE-2016-1622 affects Google Chrome prior to 48.0.2564.109. The Extensions subsystem does not prevent use of Object.defineProperty to override intended extension behavior, enabling remote attackers to bypass the Same Origin Policy via crafted JavaScript. Connected sources (e.g., Debian/Debian sec...

Google Chrome < 48.0.2564.109 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 48.0.2564.109. It is, therefore, affected by multiple vulnerabilities as referenced in the 201602stable-channel-update9 advisory. - The Developer Tools aka DevTools subsystem in Google Chrome before 48.0.2564.109 does n...

CVE-2015-1622

Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."...

CVE-2015-1622

Microsoft Internet Explorer 10/11 is affected by a memory corruption vulnerability (CVE-2015-1622) that allows remote code execution via a crafted web page. Exploitation requires visiting a malicious page or file per ZDI-15-255/ ZDI-15-082 advisories, with the vulnerability topic consolidated und...

CVE-2015-1622

Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."...

Spring Framework arbitrary code execution

No description provided by source. CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions may also be...

Directory traversal

Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-16...