CVE-2019-13400

Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info...

D-Link DCS-1130 Cross-Site Request Forgery Vulnerability (CNVD-2019-23341)

The D-Link DCS-1130 is a network camera from Taiwan, China-based AUO D-Link. A security vulnerability exists in the D-Link DCS-1130. An attacker can exploit the vulnerability to steal the credentials of an administrative user, control the device as admin user, execute arbitrary code, or change th...

CVE-2017-8229

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a user-x.squashfs.img.extracted archive which contains the filesystem set...

Nortek Security & Control Linear eMerge E3-Series License Issue Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control device from Nortek Security & Control USA. Nortek Security & Control Linear eMerge E3-Series is vulnerable to an authorization issue. An attacker can use this vulnerability to bypass authorization with a GET request, obtai...

Cisco Identity Services Engine Privilege Escalation Vulnerability (cisco-sa-20190123-ise-privilege)

According to its self-reported version, Cisco Identity Services Engine Software is affected by a privilege escalation vulnerability. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could exploit this vulnerability by authenticating to the device wi...

CVE-2019-12794

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...

CVE-2019-12794

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...

Critical Flaws in Amcrest HDSeries Camera Allow Complete Takeover

Two critical severity bugs have been publicly disclosed that impact Amcrest HDSeries model IPM-721S cameras. Both vulnerabilities open the consumer-grade $50 Wi-Fi cameras to complete takeover by remote, unauthenticated attackers. Mandar Satam, senior security researcher at Synopsys, found the si...

CVE-2018-5265

Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters...

Code injection

Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters...

CVE-2018-5265

Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters...

CVE-2018-5265

Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices is affected by CVE-2018-5265. The root cause is unsanitized shell metacharacters in the alias/ips fields of /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def, enabling remote code execution with admin credentials....

Security Bulletin: IBM Security Access Manager Appliance is affected by a security vulnerability (CVE-2019-4037)

Summary IBM Security Access Manager appliance is affected by a security vulnerability that could allow an authenticated user to execute commands with the appliance admin credentials. Vulnerability Details CVEID: CVE-2019-4037 DESCRIPTION: IBM Security Access Manager Appliance could allow an...

Input validation

A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying operating system of an affected device with elevated privileges. The vulnerability is due to...

CVE-2019-1811 Cisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not...

CVE-2019-1790

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with valid administrator credentials to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to...

CVE-2019-1778

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI comman...

CVE-2019-1770

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments...

CVE-2019-1775

Cisco NX-OS Software Command Injection vulnerability CVE-2019-1775 affects the CLI of Cisco NX-OS, where an authenticated local attacker can pass malicious CLI arguments to cause arbitrary commands to run on the underlying OS with elevated privileges. Exploitation requires valid administrator cre...

CVE-2019-1732

A vulnerability in the Remote Package Manager RPM subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use TOCTOU race condition to corrupt local variables, which could lead to arbitrary command injectio...