CVE-2019-14336: Undefined Security Weakness

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

CVE-2019-14333: Undefined Security Weakness

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi...

PT-2019-13618

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue allows for a post-authenticated dump of all configuration files through a certain "admin.cgi?action=" insecure HTTP request. Recommendations For D-Link 6600-AP and DWL-3600...

PT-2019-13615

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows a pre-authenticated denial of service attack against the access point. This can be achieved via a long action parameter to the "admin.cgi"...

PT-2019-13614

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered where weak ciphers are used for SSH, such as diffie-hellman-group1-sha1. Recommendations For D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14, consider...

PT-2019-13616

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP version 4.2.0.14 D-Link DWL-3600AP version 4.2.0.14 D-Link DWL-8610AP Ax version 4.2.0.14 Description An issue was discovered that allows post-authenticated Certificate and RSA Private Key extraction through an insecure...

PT-2019-13619

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows escaping to a shell in the restricted command line interface. This can be achieved by using the sequence /bin/sh -c wget. Recommendations For...

PT-2019-13620

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered on the management interface of the affected devices, where a post-authentication XSS vulnerability exists in the "admin.cgi?action=" API endpoint...

alions (0.0.1), ax-rocketmq (>=3.0.0, <=3.0.2) +10 more potentially affected by unknown CVE via byte (>=1.0.0, <=1.4.0)

byte NPM version =1.0.0, =3.0.0, =1.0.0, =1.0.0, =1.2.0, =1.2.4, =2.0.0, =0.0.2, =0.0.10, =0.0.13 - zoodubbo 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-XM7F-X4WX-WMGV...

Starbucks: SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database

As described in the Hacker Summary, @spaceraccoon discovered a SQL Injection vulnerability in a web service backed by Microsoft Dynamics AX. @spaceraccoon demonstrated that the flaw was exploitable via XML-formatted HTTP payload requests to the server. We appreciate @spaceraccoon's clear and...

PT-2019-9685

Name of the Vulnerable Software and Affected Versions Tridium Niagara Enterprise Security versions prior to 2.3.118.6 Tridium Niagara AX versions prior to 3.8.401.1 Tridium Niagara 4.4 versions prior to 4.4.93.40.2 Tridium Niagara 4.6 versions prior to 4.6.96.28.4 Description A cross-site scripti...

TRIDIUM Niagara Enterprise Security, Niagara AX and Niagara Cross-Site Scripting Vulnerabilities

TRIDIUM Niagara Enterprise Security, Niagara AX, and Niagara are all products of Tridium, Inc.TRIDIUM Niagara Enterprise Security is a set of access control and security systems for the construction industry.Niagara AX is a Niagara is a platform for supporting device and application connectivity....

ICSA-18-333-02_Tridium Niagara Enterprise Security, Niagara AX, and Niagara 4

1. EXECUTIVE SUMMARY CVSS v3 5.7 ATTENTION : Exploitable remotely/low skill level Vendor : Tridium Equipment : Niagara Enterprise Security, Niagara AX, and Niagara 4 Vulnerability : Cross-site Scripting 2. REPOSTED INFORMATION This advisory was originally posted to the HSIN ICS-CERT library on...

Tridium Niagara AX Framework and Niagara 4 Framework Path Traversal Vulnerability

Tridium Niagara AX Framework and Niagara 4 Framework are both IoT business application frameworks from Tridium USA. A path traversal vulnerability exists in Tridium Niagara AX Framework 3.8 and earlier and Niagara 4 Framework 4.4 and earlier, where the program fails to adequately filter...

CVE-2017-16744

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

CVE-2017-16744

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

CVE-2017-16748

An attacker can log into the local Niagara platform Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system...

Path traversal

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

CVE-2017-16748

CVE-2017-16748 affects Tridium Niagara AX/Niagara 4 platforms: Niagara AX Framework 3.8 and earlier and Niagara 4 Framework 4.4 and earlier. The issue is improper authentication where an attacker can log in using a disabled account name with a blank password and gain administrator privileges on t...

CVE-2017-16748: Improper Authentication

An attacker can log into the local Niagara platform Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system...