41 matches found
VulnCheck KEV: CVE-2013-5948
The Network Analysis tab MainAnalysisContent.asp in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field destIP parameter...
CVE-2015-5948
Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947...
CVE-2015-5948
Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947...
OnePlus OTA Downgrade Vulnerability(CVE-2017-5948)
Products OnePlus 3T OnePlus 3 OnePlus 2 OnePlus X OnePlus One Vulnerable Version All OnePlus OxygenOS & HydrogenOS OTAs Technical Details lenient updater-script in the OnePlus OTAs which does not check that the current version is lower than or equal to the given image’s see below the 4.0.0...
OnePlus OTA Lack of TLS Vulnerability(CVE-2016-10370)
Summary The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs due to the digital signature, it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as...
Design/Logic Flaw
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs due to the digital signature, it unnecessarily increases the attack surface, and allows for remote...
CVE-2016-10370
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs due to the digital signature, it unnecessarily increases the attack surface, and allows for remote...
CVE-2016-10370
An issue linked to CVE-2016-10370 affects OnePlus OTA updaters on devices such as OnePlus 3/3T: the OTA image is delivered over HTTP without TLS, increasing the attack surface and enabling potential exploitation of other vulnerabilities (CVE-2017-5948, CVE-2017-8850, CVE-2017-8851). The root caus...
CVE-2017-5948
CVE-2017-5948 is a downgrade-attack vulnerability in OnePlus OxygenOS and HydrogenOS OTA updates. The root cause is a lenient updater-script in OTAs for OnePlus One, X, 2, 3, and 3T that does not enforce that the current version is
CVE-2016-5948
CVE-2016-5948 affects IBM Kenexa LCMS Premier on Cloud. The vulnerability is a cross-site scripting flaw in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Documented CVSS v3.0 vector: CVSS:3.0/AV:N/AC:...
CVE-2014-5948
CVE-2014-5948 affects the Obama for America Android app (com.barackobama.ofa) v1.02. The issue is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NVD reports a base ...
CVE-2013-5948
CVE-2013-5948 documents concrete details: Affected devices are ASUS RT-AC68U and other RT-series routers with firmware before 3.0.0.4.374.5047. The issue resides in the Network Analysis tab (Main_Analysis_Content.asp), where remote authenticated users can cause arbitrary commands to run via shell...
CVE-2012-5948
CVE-2012-5948 covers multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8. The described attack vectors include WebProcess.srv, the html/en/default/ directory, Widget/resource, birt/frameset, and ganttlib/gantt-jws.jnlp. The NVD ent...
SuSE 10 Security Update : audiofile (ZYPP Patch Number 5948)
A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code. CVE-2008-5824 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...
CVE-2008-5948
Directory traversal vulnerability in index.php in BNCwi 1.04 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the newlanguage parameter...
CVE-2008-5948
CVE-2008-5948 concerns a directory traversal vulnerability in index.php of BNCwi version 1.04 and earlier. The issue arises when processing the newlanguage parameter, where an attacker can inject a .. path segment to cause local files to be included and (potentially) executed. Impact is partial c...
CVE-2008-5948
Directory traversal vulnerability in index.php in BNCwi 1.04 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the newlanguage parameter...
CVE-2007-5948
SF-Shoutbox 1.2.1 through 1.4 contains multiple XSS vulnerabilities in main.php that allow remote attackers to inject arbitrary script or HTML via the nick (Name) and shout (Shout) parameters. Affected component: SF-Shoutbox main.php; vulnerable versions: 1.2.1–1.4. The root cause is improper san...
CVE-2007-5948
Multiple cross-site scripting XSS vulnerabilities in main.php in SF-Shoutbox 1.2.1 through 1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 nick aka Name and 2 shout aka Shout parameters...