Design/Logic Flaw

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...

CVE-2018-16792

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

CVE-2018-16792

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

CVE-2018-16792: Improper Restriction of XML External Entity Reference

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

PT-2018-13752

Name of the Vulnerable Software and Affected Versions SolarWinds SFTP/SCP server through 2018-09-10 Description The issue allows an attacker to exploit a world-readable and writable configuration file, leading to XXE XML External Entity vulnerability. This vulnerability enables an attacker to...

PT-2018-13751

Name of the Vulnerable Software and Affected Versions SolarWinds SFTP/SCP Server versions prior to 2018-09-10 Description The configuration file of the affected software is world readable and writable, storing user passwords insecurely. This allows an attacker to determine passwords for potential...

Code Execution Vulnerability in Tianmu MVC Website Management System Home Edition

Tianmu MVC website management system is Pizhou Tianmu Network Technology Co., Ltd. developed a professional PHP + MYSQL products, the use of independent MVC framework, applicable to large and small and medium-sized enterprises of the open source MVC. Tianmu MVC website management system Home...

Default credentials

TP-Link Archer C5 devices through V2160201US allow remote command execution via shell metacharacters on the wandynhostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin ma...

CVE-2018-19537

TP-Link Archer C5 devices through V2160201US allow remote command execution via shell metacharacters on the wandynhostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin ma...

CVE-2018-19537

TP-Link Archer C5 devices through V2160201US allow remote command execution via shell metacharacters on the wandynhostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin ma...

PT-2018-14986

Name of the Vulnerable Software and Affected Versions TP-Link Archer C5 devices through V2 160201 US Description The issue allows remote command execution via shell metacharacters on the wan dyn hostname line of a configuration file. This configuration file is encrypted with the 478DA50BF9E3D2CF...

TP-Link Archer C5 Remote Command Execution Vulnerability

TP-LINK Archer C5 is a wireless router product from China P&L TP-LINK. A security vulnerability exists in TP-Link Archer C5 V2160201US and previous versions. The vulnerability can be exploited by an attacker to execute commands with the help of the 'wandynhostname' parameter of the configuration...

Exploit for Unrestricted Upload of File with Dangerous Type in Tp-Link Archer_C5_Firmware

TP-Link Archer C5 Authenticated RCE Through Malicious Configur...

[SECURITY] Fedora 29 Update: libconfuse-3.2.2-1.fc29

libConfuse is a configuration file parser library, licensed under the terms of the ISC license, and written in C. It supports sections and lists of values strings, integers, floats, booleans or other sections, as well as some other features such as single/double-quoted strings, environment variab...

[SECURITY] Fedora 27 Update: libconfuse-3.2.2-1.fc27

libConfuse is a configuration file parser library, licensed under the terms of the ISC license, and written in C. It supports sections and lists of values strings, integers, floats, booleans or other sections, as well as some other features such as single/double-quoted strings, environment variab...

Default credentials

Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password...

CVE-2018-16222

Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password...

CVE-2018-16222

The CVE-2018-16222 entry affects the iSmartAlarm Android app (up to version 2.0.8). The issue is cleartext storage of credentials in the iSmartAlarmData.xml configuration file, which can allow an attacker to retrieve the username and password. The connected documents confirm affected product comp...

CVE-2018-16222

Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password...

TP-Link Archer C50 Wireless Router 171227 - CSRF (Configuration File Disclosure) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Exploit Author: Wadeek Vendor Homepage: https://www.tp-link.com/ Hardware Version: Archer C50 v3 00000001 Firmware Link:...