CVE-2017-9980: Improper Neutralization of Special Elements used in a Command

In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" aka tagipPing feature within the web interface allows performing command injection, via the "pip" parameter...

CVE-2017-9931: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to ajax.cgi...

CVE-2017-9930: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables UPnP...

CVE-2017-9932: Use of Hard-coded Credentials

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account...

PT-2017-19293

Name of the Vulnerable Software and Affected Versions Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb Description A Cross-Site Request Forgery CSRF issue exists, as demonstrated by a request to "ajax.cgi" that enables UPnP. This allows for unauthorized actions. Recommendations For Gre...

PT-2017-19318

Name of the Vulnerable Software and Affected Versions Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb Description The issue concerns command injection via the pip parameter in the PING feature, also known as tag ipPing, within the web interface. Recommendations For Green Packet DX-350...

PT-2017-19294

Name of the Vulnerable Software and Affected Versions Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb Description A Cross-Site Scripting XSS issue exists, as demonstrated by the action parameter to "ajax.cgi". Recommendations For Green Packet DX-350 Firmware version...

PT-2017-19295

Name of the Vulnerable Software and Affected Versions Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb Description The issue concerns a default password set for the admin account, which is 'admin'. This could potentially allow unauthorized access to the device. Recommendations For Gree...

Cheers to a successful time at Infosec Europe 2017

With over 350 exhibitors, well over 10,000 visitors, and many widely respected speakers, Infosec Europe is one of Europe's biggest security events. The Malwarebytes stand attracted a lot of interested people, even without our robot Zero, who had obligations elsewhere. The new EMEA Channel...

Green Packet DX-350 contains insecure default credentials

Overview Green Packet DX-350 uses default credentials Description CWE-255: Credentials Management - CVE-2016-6552Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device. --- Impact A remote attacker can ta...

Westermo MRD-305-DIN/MRD-310/MRD-315/MRD-330/MRD-355/MRD-350/MRD-455 弱口令

No description provided by source...

Veeder-Root Automatic Tank Gauge (ATG) Administrative Client

This module acts as a simplistic administrative client for interfacing with Veeder-Root Automatic Tank Gauges ATGs or other devices speaking the TLS-250 and TLS-350 protocols. This has been tested against GasPot and Conpot, both honeypots meant to simulate ATGs; it has not been tested against...

Threat Outbreak Alert RuleID14083: Email Messages Distributing Malicious Software on March 18, 2015

Medium Alert ID: 37917 First Published: 2015 March 18 16:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14083 may contain the following files: Name | Si...

Amazon Linux AMI : openssl098e (ALAS-2014-350)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. CVE-2014-0224 C Tenable Network...

RhinoSoft Serv-U FTP Server 7.2.0.1 'rnto' Command Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31563/info RhinoSoft Serv-U FTP server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue allows an attacker to write arbitrar...

Slackware 14.1 / current : mozilla-firefox (SSA:2013-350-04)

New mozilla-firefox packages are available for Slackware 14.1 and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-350-04. The text itself is copyright ...

Slackware 14.0 / 14.1 / current : llvm (SSA:2013-350-03)

New llvm packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-350-03. The text itself is copyright C...

Enterasys NetSight nssyslogd.exe Buffer Overflow Vulnerability

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

Enterasys NetSight - 'nssyslogd.exe' Remote Buffer Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Enterasys NetSight nssyslogd.exe Buff...

Enterasys NetSight nssyslogd.exe Buffer Overflow

This module exploits a stack buffer overflow in Enterasys NetSight. The vulnerability exists in the Syslog service nssylogd.exe when parsing a specially crafted PRIO from a syslog message. The module has been tested successfully on Enterasys NetSight 4.0.1.34 over Windows XP SP3 and Windows 2003...