CVE-2018-11748

Previous releases of the Puppet devicemanager module creates configuration files containing credentials that are world readable. This issue has been resolved as of devicemanager 2.7.0...

CVE-2018-11748

CVE-2018-11748 affects the Puppet device_manager module. Previous releases create configuration files that contain credentials and are world-readable, enabling credential exposure. This issue is fixed in device_manager 2.7.0 . Exploitation details are not provided in the documents; remediation is...

CVE-2018-11078

Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from VPN configuration files on and potentially author a MITM attack on the VPN traffic...

CVE-2018-11078

Dell EMC VPlex GeoSynchrony

CVE-2018-16715

An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %ProgramData%\CTES folder and sub-folders may allow write access to low-privileged user accounts. This allows unauthorized replacement of service program executable EXE or dynamical...

CVE-2018-16715

An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %ProgramData%\CTES folder and sub-folders may allow write access to low-privileged user accounts. This allows unauthorized replacement of service program executable EXE or dynamical...

The vulnerability of CGI applications of microprogramming software for controlled switches from FL SWITCH allows a hacker to access the contents of configuration files.

The vulnerability of CGI applications of microprogramming software for controlled switches from FL SWITCH Phoenix Contact is related to security mechanisms that are flawed. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to configuration files’ contents...

ASUSTOR Data Master Cross-Site Scripting Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A cross-site scripting vulnerability exists in ADM 3.1.5 and prior versions, which originates when the program uses HTTP requests for configuration files. A remote attacker can exploit this...

The vulnerability of the microprogramming software of the 4G LTE Light Industrial M2M Router (NWL-25) is related to insufficient protection of configuration data, allowing attackers to gain unauthorized access to protected data.

The vulnerability of the microprogramming software of the 4G LTE Light Industrial M2M Router NWL-25 is related to insufficient protection of configuration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to configuration files and profiles...

NetComm NWL-25 Information Disclosure Vulnerability

The NetComm NWL-25 is a 4G LTE industrial grade M2M router. An information disclosure vulnerability exists in the NetComm NWL-25 using firmware version 2.0.29.11 and earlier, which can be exploited by an attacker to access configuration files without authentication...

CVE-2018-14782

NetComm Wireless G LTE Light Industrial M2M Router NWL-25 with firmware 2.0.29.11 and prior. The device allows access to configuration files and profiles without authenticating the user...

Design/Logic Flaw

NetComm Wireless G LTE Light Industrial M2M Router NWL-25 with firmware 2.0.29.11 and prior. The device allows access to configuration files and profiles without authenticating the user...

CVE-2018-14782

NetComm Wireless G LTE Light Industrial M2M Router NWL-25 with firmware 2.0.29.11 and prior. The device allows access to configuration files and profiles without authenticating the user...

Ericson-LG iPECS NMS 30M Directory Traversal Vulnerability

The Ericsson-LG iPECS NMS is a network management solution from Ericson-LG in Korea. A directory traversal vulnerability exists in Ericsson-LG iPECS NMS 30M. An attacker can exploit the vulnerability to directly download configuration files...

LG-Ericsson iPECS NMS 30M - Directory Traversal

LG-Ericsson iPECS NMS 30M - Directory Traversal Exploit Title: LG-Ericsson iPECS NMS 30M - Directory Traversal Shodon Dork: iPECS CM Exploit Author: Safak Aslan Software Link: www.ipecs.com Version: 30M-B.2Ia and 30M-2.3Gn Authentication Required: No Tested on: Linux CVE: N/A Description The...

LG-Ericsson iPECS NMS 30M Directory Traversal

Exploit Title: LG-Ericsson iPECS NMS 30M - Directory Traversal Shodon Dork: iPECS CM Exploit Author: Safak Aslan Software Link: www.ipecs.com Version: 30M System Authentication Required: No Tested on: Linux CVE: N/A Description The directory traversal was detected on LG-Ericsson's iPECS product...

Design/Logic Flaw

It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group root:jboss, 664. On systems using classic /etc/init.d init scripts i.e. on Red Hat Enterprise Linux 6 a...

CVE-2016-8657

It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group root:jboss, 664. On systems using classic /etc/init.d init scripts i.e. on Red Hat Enterprise Linux 6 a...

CVE-2016-8657

CVE-2016-8657 affects Red Hat JBoss EAP on Red Hat Enterprise Linux where /etc/sysconfig/jbossas was created with insecure permissions (root:jboss, 664), making it writable by the jboss group. On systems using classic /etc/init.d scripts (RHEL 6 and earlier), the file is sourced by the jboss init...

[SECURITY] [DLA 1444-1] vim-syntastic security update

Package : vim-syntastic Version : 3.5.0-1+deb8u1 CVE ID : CVE-2018-11319 CVE-2018-11319 The improper handling of search for configuration files might be exploited for arbitrary code execution via a malicious gcc plugin. For Debian 8 "Jessie", this problem has been fixed in version 3.5.0-1+deb8u1...