CVE-2018-4019

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

CVE-2018-4019

Netgate pfSense CE 2.4.4-RELEASE is affected by three remote command-injection vulnerabilities in the POST handling of system_advanced_misc.php (powerd_normal_mode, powerd_ac_mode, powerd_battery_mode). An attacker must authenticate to the pfSense web admin interface to exploit these via crafted ...

CVE-2018-4020

PfSense CE 2.4.4-RELEASE is affected by three command-injection vulnerabilities in POST handlers of system_advanced_misc.php, via powerd_normal_mode, powerd_ac_mode, and powerd_battery_mode parameters. The root cause is improper sanitization of these POST values, allowing an authenticated attacke...

PT-2018-16368

Name of the Vulnerable Software and Affected Versions Netgate pfSense CE version 2.4.4-RELEASE Description A command injection issue exists in the way Netgate pfSense CE processes the parameters of a specific POST request, allowing an attacker to execute arbitrary commands on the system. The...

PT-2018-16369

Name of the Vulnerable Software and Affected Versions pfSense CE version 2.4.4-RELEASE Description A command injection issue exists in the way pfSense CE processes the parameters of a specific POST request, allowing an attacker to execute arbitrary commands on the system. The attacker must be abl...

CVE-2018-4020: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

PT-2018-16367

Name of the Vulnerable Software and Affected Versions pfSense CE version 2.4.4-RELEASE Description A command injection issue exists in the way pfSense CE processes the parameters of a specific POST request. This allows an attacker to execute arbitrary commands on the system by exploiting the powe...

CVE-2018-4021: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

CVE-2018-4019: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

Siemens SIMATIC HMI Device Detection Consolidation

Consolidation of Siemens SIMATIC HMI device detections. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Buying Used Voting Machines on eBay

This is not surprising: This year, I bought two more machines to see if security had improved. To my dismay, I discovered that the newer model machines -- those that were used in the 2016 election -- are running Windows CE and have USB ports, along with other components, that make them even easie...

Code injection

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATHINFO...

CVE-2018-18635

MailCleaner CE is affected by CVE-2018-18635, a cross-site scripting vulnerability in the admin login interface. The issue is in www/guis/admin/application/controllers/UserController.php and can be exploited via PATH_INFO on the admin/login/user/message/ page to inject arbitrary script/HTML. Repo...

CVE-2018-18635

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATHINFO...

CVE-2018-18635

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATHINFO...

PT-2018-14548

Name of the Vulnerable Software and Affected Versions MailCleaner CE versions 2018.08 through 2018.09 Description The issue concerns the administration login interface, where an XSS attack can be performed via the admin/login/user/message/ PATH INFO. Recommendations For MailCleaner CE versions...

CVE-2018-18635: Improper Neutralization of Input During Web Page Generation

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATHINFO...

IoT Adventures: The LeFun WiFi Camera

Recently I happened to be in the market for a baby monitor, so I decided to search Amazon for an affordable device that would fit my needs. A search for "baby monitor" within the "electronics" department brought me to the LeFun WiFi Camera. For $39.99 at the time of my purchase, this seemed like ...

CVE-2018-12605

An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'urlfor' contained a XSS issue due to it allowing arbitrary protocols as a parameter...

CVE-2018-12606

GitLab CE/EE versions prior to 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1 contain a persistent XSS in the wiki due to lack of output encoding in a specific markdown feature. Mitigation: upgrade to 10.7.6, 10.8.5, or 11.0.1+ (the fixed versions). Other details across sources corroborate ...