CVE-2018-19233

COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in an Inventory Agent configuration file...

CVE-2018-18441: Exposure of Sensitive Information to an Unauthorized Actor

D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many mor...

PT-2018-3942

Name of the Vulnerable Software and Affected Versions D-Link DCS series Wi-Fi cameras versions 1.00 and above Description The issue is related to insufficient protection of registration data in the common/info.cgi component of D-Link DCS series Wi-Fi cameras' firmware. This can allow a remote...

XXL-CONF Path Traversal vulnerability

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

GHSA-8J39-FGFP-VXH8 XXL-CONF Path Traversal vulnerability

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-16873

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not ...

Multiple Siemens Products Protection Mechanism Failure Vulnerability

Siemens SINUMERIK 808D and so on are the German Siemens Siemens company's CNC machine tool system controller. A security vulnerability exists in Siemens SINUMERIK CNC Controller. A local attacker can exploit this vulnerability by modifying a user-writable configuration file to execute code with...

Directory Traversal

xxl-conf-core is vulnerable to directory traversal attacks. The vulnerable exists due to the lack of sanitization on the value of pathname, allowing the download of any configuration file using the ../ characters...

CVE-2018-11459

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. A local attacker could modify a user-writeable...

CVE-2018-11459

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. A local attacker could modify a user-writeable...

CVE-2018-11459

Siemens SINUMERIK controllers are affected: SINUMERIK 808D v4.7/all versions and v4.8, SINUMERIK 828D v4.7, and SINUMERIK 840D sl v4.7/v4.8 (specific sub-versions). Root cause: attacker-modifiable, user-writeable configuration files can be reloaded after reboot or manual start, causing attacker-c...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

Path traversal

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-20094

CVE-2018-20094 affects XXL-CONF 1.6.0 via a path-traversal flaw in the keys parameter that can download arbitrary configuration files. The root cause is described as insufficient validation in ConfController.java and PropUtil.java, enabling an attacker to access sensitive configuration data. The ...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

PT-2018-15254

Name of the Vulnerable Software and Affected Versions XXL-CONF version 1.6.0 Description The issue is related to a path traversal vulnerability via ../ in the keys parameter, which can be used to download any configuration file. This is associated with ConfController.java and PropUtil.java...

PT-2018-2195

Name of the Vulnerable Software and Affected Versions SINUMERIK 808D V4.7 SINUMERIK 808D V4.8 SINUMERIK 828D versions prior to V4.7 SP6 HF1 SINUMERIK 840D sl versions prior to V4.7 SP6 HF5 SINUMERIK 840D sl versions prior to V4.8 SP3 Description The issue is related to insufficient protection of...

SolarWinds SFTP Insecure Password Storage Vulnerability

SolarWinds SFTP is an FTP service program. An insecure password storage vulnerability exists in SolarWinds SFTP. The vulnerability is due to the configuration file being globally readable and writable and storing user passwords in an insecure manner, allowing an attacker to determine passwords fo...