CVE-2017-9931

Cross-Site Scripting XSS exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to ajax.cgi...

Default credentials

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account...

CVE-2017-9932

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account...

CVE-2017-9930

CVE-2017-9930 affects Green Packet DX-350 firmware version v2.8.9.5-g1.4.8-atheeb. The CSRF vulnerability is triggered by a request to ajax.cgi that enables UPnP, exposing control of UPnP functionality to an attacker. The linked sources confirm the device and firmware version, and describe the vu...

CVE-2017-9980

CVE-2017-9980 affects Green Packet DX-350 firmware (example: v2.8.9.5-g1.4.8-atheeb). The web interface’s PING feature (tag_ipPing) can be abused to perform command injection via the pip parameter, enabling arbitrary commands to be executed through the vulnerable web interface. The issue is evide...

CVE-2017-9932

The CVE concerns Green Packet DX-350 with firmware v2.8.9.5-g1.4.8-atheeb where the admin account uses a default password (admin). This creates an unauthenticated credential risk with high severity: CVSS v2 base 7.5 (HIGH) and CVSS v3 base 9.8 (CRITICAL). The provided sources identify the issue a...

CVE-2017-9980

In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" aka tagipPing feature within the web interface allows performing command injection, via the "pip" parameter...

CVE-2017-9931

Green Packet DX-350 firmware v2.8.9.5-g1.4.8-atheeb contains a cross-site scripting (XSS) vulnerability. The flaw is triggered by the action parameter to ajax.cgi, enabling injection of arbitrary web script or HTML in the affected device.

CVE-2017-9930

Cross-Site Request Forgery CSRF exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables UPnP...

CVE-2017-9932

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account...

Cheers to a successful time at Infosec Europe 2017

With over 350 exhibitors, well over 10,000 visitors, and many widely respected speakers, Infosec Europe is one of Europe's biggest security events. The Malwarebytes stand attracted a lot of interested people, even without our robot Zero, who had obligations elsewhere. The new EMEA Channel...

Green Packet DX-350 contains insecure default credentials

Overview Green Packet DX-350 uses default credentials Description CWE-255: Credentials Management - CVE-2016-6552Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device. --- Impact A remote attacker can ta...

Westermo MRD-305-DIN/MRD-310/MRD-315/MRD-330/MRD-355/MRD-350/MRD-455 弱口令

No description provided by source...

Veeder-Root Automatic Tank Gauge (ATG) Administrative Client

This module acts as a simplistic administrative client for interfacing with Veeder-Root Automatic Tank Gauges ATGs or other devices speaking the TLS-250 and TLS-350 protocols. This has been tested against GasPot and Conpot, both honeypots meant to simulate ATGs; it has not been tested against...

Threat Outbreak Alert RuleID14083: Email Messages Distributing Malicious Software on March 18, 2015

Medium Alert ID: 37917 First Published: 2015 March 18 16:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14083 may contain the following files: Name | Si...

Amazon Linux AMI : openssl098e (ALAS-2014-350)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. CVE-2014-0224 C Tenable Network...

RhinoSoft Serv-U FTP Server 7.2.0.1 'rnto' Command Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31563/info RhinoSoft Serv-U FTP server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue allows an attacker to write arbitrar...

Slackware 14.0 / 14.1 / current : llvm (SSA:2013-350-03)

New llvm packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-350-03. The text itself is copyright C...

Slackware 14.1 / current : mozilla-firefox (SSA:2013-350-04)

New mozilla-firefox packages are available for Slackware 14.1 and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-350-04. The text itself is copyright ...

Enterasys NetSight - 'nssyslogd.exe' Remote Buffer Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Enterasys NetSight nssyslogd.exe Buff...