CVE-2016-1434: Improper Input Validation

The license-certificate upload functionality on Cisco 8800 phones with software 11.01 allows remote authenticated users to delete arbitrary files via an invalid file, aka Bug ID CSCuz03010...

CVE-2016-1435

CVE-2016-1435 affects Cisco’s 8800 Series IP Phones running software 11.0(1) , where mounted-filesystem permissions are not properly enforced. The vulnerability allows local users with shell access to write to arbitrary files and potentially modify system content. The root cause is insufficient e...

PT-2016-4785

Name of the Vulnerable Software and Affected Versions Cisco 8800 phones version 11.01 Description The issue concerns improper enforcement of mounted-filesystem permissions, allowing local users with shell access to write to arbitrary files. Recommendations For Cisco 8800 phones version 11.01,...

Cisco IP Phone 8800 Series Directory Traversal Vulnerability

Cisco IP Phone 8800 Series is an 8000 series IP phone product from Cisco USA. The product provides voice and video features. A directory traversal vulnerability exists in the Cisco IP Phone 8800 Series using software version 11.01. A remote attacker could exploit this vulnerability by uploading a...

Cisco IP Phone 8800 Series Unauthorized Access Vulnerability

Cisco IP Phone 8800 Series is an 8000 series IP phone product from Cisco USA. The product provides voice and video features. An unauthorized access vulnerability exists in the Cisco IP Phone 8800 Series using software version 11.01. An attacker could exploit this vulnerability to gain access and...

Cisco 8800 Series IP Phone Filesystem Permission Enforcement Unauthorized Access Vulnerability

A vulnerability in the mounted filesystem of Cisco 8800 Series IP Phones could allow an authenticated, remote attacker to access any file, including the right to change the file mode, on a targeted device. The vulnerability is due to insufficient enforcement of filesystem permissions. An attacker...

Cisco IP 8800 Device Web Application Denial of Service Vulnerability

Cisco IP 8800 Series Phones are digital phone system products. The web application of the Cisco IP 8800 Series Phones does not properly check the size of input data, which can be exploited by an unauthenticated, remote attacker to cause the web server process to stop responding, resulting in a...

CVE-2015-8800

CVE-2015-8800 affects Symantec SES:CSP/SDCS:SA and related components: SES:CSP 1.0.x before 1.0 MP5, SES:CSP for Controllers and Devices 6.5.0 before MP1, SCSP before 5.2.9 MP6, DCS:SA 6.x before 6.5 MP1 and 6.6 before MP1, and DCS:SA and Agents through 6.6 MP1. The issue allows remote authentica...

Cisco IP 8800 phone privilege acquisition vulnerability

Cisco IP 8800 phone is a phone product from Cisco USA that provides video and VoIP communication features. A privilege acquisition vulnerability exists in the Cisco IP 8800 phone using software version 11.0.1 and earlier. A local attacker can use specially crafted CLI commands to gain privileges ...

Command injection

CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands, aka Bug ID CSCuz03005...

CVE-2016-1403

CVE-2016-1403 affects Cisco IP 8800 Series Phones running firmware 11.0.1 and earlier. A vulnerability in the btcli CLI utility allows an authenticated, local attacker to inject commands and gain OS-level privileges due to insufficient input validation. Impact is local privilege escalation with p...

PT-2016-4765

Name of the Vulnerable Software and Affected Versions CISCO IP 8800 phones versions 11.0.1 and earlier Description The issue allows local users to gain privileges for OS command execution via crafted CLI commands. Recommendations For versions 11.0.1 and earlier, update to a version later than...

CVE-2016-1403: Improper Input Validation

CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands, aka Bug ID CSCuz03005...

Cisco IP 8800 Series Phones btcli Utility Command Injection Vulnerability

A vulnerability in a command-line interface CLI utility of the Cisco IP 8800 Series Phones could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted...

CVE-2014-8800

Cross-site scripting XSS vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fbloginbutton parameter in a newfbupdateoptions action...

CVE-2014-8800

Cross-site scripting XSS vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fbloginbutton parameter in a newfbupdateoptions action...

CVE-2014-8800

CVE-2014-8800 is a cross-site scripting (XSS) vulnerability in the Nextend Facebook Connect WordPress plugin prior to 1.5.1. The issue affects nextend-facebook-settings.php via the fb_login_button parameter in a newfb_update_options action, enabling remote injection of arbitrary HTML/script. Publ...

WordPress Plugin Nextend Facebook Connect 1.4.59 - Cross-Site Scripting

WordPress Plugin Nextend Facebook Connect 1.4.59 - Cross-Site Scripting Exploit Title: Nextend Facebook Connect 1.4.59 XSS Date: 16-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link:...

WordPress Plugin Nextend Facebook Connect 1.4.59 - Cross-Site Scripting

Exploit Title: Nextend Facebook Connect 1.4.59 XSS Date: 16-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://downloads.wordpress.org/plugin/nextend-facebook-connect.1.4.59.zip Category: webapps CVE: CVE-2014-8800 1...

深澜软件鸡肋漏洞可被getshell

简要描述： 深澜软件鸡肋漏洞造成getshell 详细说明： 有好几个鸡肋漏洞，就造成了getshell。 本例以中枪的陕西科技大学为例。 1.爆路径问题http://xxxx.xx:8080/global.php，所有均存在路径泄露 不过实际路径是/srun3/srun/services/ （1）80端口路径/srun3/web/ （2）8800端口路径/srun3/srun/services/ （3）8080/8081端口路径/srun3/srun/web/ 2.管理后台（8080/8081端口），默认口令 support...