2933 matches found
Design/Logic Flaw
On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the cle...
CVE-2018-15328
On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the cle...
Nagios: Privilege escalation
Background Nagios is an open source host, service and network monitoring program. Description A vulnerability in Nagios was discovered due to the improper handling of configuration files which can be owned by a non-root user. Impact A local attacker can escalate privileges to root by leveraging...
CVE-2018-17936
NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution...
Remote code execution
NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution...
WPScan v3.4.0 - Black Box WordPress Vulnerability Scanner
WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites. INSTALL Prerequisites: Ruby = 2.2.2 - Recommended: 2.3.3 Curl = 7.21 - Recommended: latest - FYI the 7.29 has a segfault...
Asynchronous Target Enumeration Tool: bscan
bscan is a command-line utility to perform active information gathering and service enumeration. At its core, bscan asynchronously spawns processes of well-known scanning utilities, repurposing scan results into highlighted console output and a well-defined directory structure. bscan was written ...
Versa Networks: Plaintext Credentials in Backups & Configs
In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for various application components such as SNMP, and SSL and Trust keystores...
CVE-2018-0284
A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local status page. An exploit could allow the...
CVE-2018-0284 Cisco Meraki Local Status Page Privilege Escalation Vulnerability
A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local status page. An exploit could allow the...
RHEL 7 : setup (RHSA-2018:3249)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:3249 advisory. The setup package contains a set of important default system configuration and setup files. Examples include /etc/passwd, /etc/group, and /etc/profil...
Denial of Service Vulnerability in Kewe's Text Display Screen Configuration Software KEC330
Kewei text display screen configuration software KEC330 is a replacement for the traditional panel controller, intelligent small human-machine interface. A denial of service vulnerability exists in KEC330, Kewe's text display screen configuration software. An attacker can cause the program to cra...
Ubuntu: Security Advisory (USN-3489-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Arbitrary File Read Vulnerability in Metadata Platform (MetaCube) of Puyuan Information Technology Co.
Metadata Platform MetaCube of Puyuan Information Technology Co., Ltd. is a tool support for enterprises to establish metadata management system. An arbitrary file read vulnerability exists in MetaCube of Puyuan Information Technology Co. An attacker can exploit the vulnerability to read...
Arbitrary File Download Vulnerability in Wiktionary 51eweb System
Ltd. is a one-stop service company engaging in the service and development of network and related products, and providing professional informatization solutions and other one-stop services for customers. A file download vulnerability exists in the 51eweb system, which can be exploited by an...
WPScan v3.3.1 - Black Box WordPress Vulnerability Scanner
WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites. INSTALL Prerequisites: Ruby = 2.2.2 - Recommended: 2.3.3 Curl = 7.21 - Recommended: latest - FYI the 7.29 has a segfault...
CVE-2017-18348
Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that non-root account to modify $SPLUNKHOME/etc/splunk-launch.conf and insert Trojan horse programs into $SPLUNKHOME/bin, becau...
Input validation
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The application contains multiple configuration files with world-readable permissions that could allow an authenticated malicious user to utilize the file contents to potentially...
[SECURITY] Fedora 27 Update: calamares-3.1.8-2.fc27.1
Calamares is a distribution-independent installer framework, designed to in stall from a live CD/DVD/USB environment to a hard disk. It includes a graphical installation program based on Qt 5. This package includes the Calamares framework and the required configuration files to produce a working...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : AppArmor update (USN-3784-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3784-1 advisory. As a security improvement, this update adjusts the private-files abstraction to disallow writing to thumbnailer configuration files...