Martem TELEM GW6/GWM Privilege Vulnerability

Martem TELEM GW6/GWM are both data processor products of Martem Estonia. A security vulnerability exists in previous versions of Martem TELEM GW6/GWM 2.0.87-4018403-k4. An attacker can exploit the vulnerability by connecting to the RTU using default credentials to modify/upload new system...

CVE-2018-13800

A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 All versions V4.2.3. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a...

PT-2018-12195

Name of the Vulnerable Software and Affected Versions SIMATIC S7-1200 CPU family versions prior to V4.2.3 Description A security issue has been identified that could allow a Cross-Site Request Forgery CSRF attack through the web interface. This attack requires user interaction by a legitimate use...

CVE-2018-0453

A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense FTD sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center FM...

CVE-2018-0453: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense FTD sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center FM...

PT-2018-8838

Name of the Vulnerable Software and Affected Versions Cisco Firepower System Software affected versions not specified Description A vulnerability exists in the Sourcefire tunnel control channel protocol, allowing an authenticated, local attacker with root privileges to execute specific CLI comman...

JVN#00344155: Multiple vulnerabilities in Denbun

Denbun provided by NEOJAPAN Inc. is a WebMail System. Denbun contains multiple vulnerabilities listed below. Hard-coded credentials for user account CWE-798 - CVE-2018-0680 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2|...

CVE-2018-16832

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header...

CVE-2018-16832

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header...

PT-2018-13765

Name of the Vulnerable Software and Affected Versions xunfeng version 0.2.0 Description The issue allows an attacker to modify the configuration via a Flash file. This is possible because the views/lib/AntiCSRF.py file can overwrite the request.host value with the content of the X-Forwarded-Host...

CVE-2018-16337

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

Cross site request forgery (csrf)

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

CVE-2018-16337: Cross-Site Request Forgery (CSRF)

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

PT-2018-13499

Name of the Vulnerable Software and Affected Versions Cscms version 4.1.8 Description An issue was discovered that allows modification of a website's basic configuration via a CSRF vulnerability. This can be exploited through the "upload/admin.php/setting/save" API endpoint. Recommendations For...

PT-2018-15186

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.132 and earlier Jenkins versions 2.121.1 and earlier Description A vulnerability exists that allows unauthorized modification of configuration, enabling attackers to provide crafted login credentials. This can cause Jenkins ...

CVE-2018-11447: Stack-based Buffer Overflow

A vulnerability has been identified in SCALANCE M875 All versions. The web interface on port 443/tcp could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by an legitimate user, wh...

CVE-2018-0293: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in role-based access control RBAC for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a nonadministrative user. The attacker would have to possess valid user credentials for the device. The vulnerability is d...

PT-2018-8733

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software affected versions not specified Description: A vulnerability in role-based access control RBAC for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a...

CVE-2018-8898

The CVE-2018-8898 entry concerns D-Link DSL-3782 routers, where the Login Panel authentication mechanism is flawed. A flaw in the Login Panel allows unauthenticated attackers to perform arbitrary read/write operations on passwords and configurations while an administrator is logged into the web p...

Inteno IOPSYS 2.0 - 4.2.0 p910nd - Remote Command Execution Exploit

Exploit for hardware platform in category remote exploits ''' Any authenticated user can modify the configuration for it in a way which allows them to read and append to any file as root. This leads to information disclosure and remote code execution. This vulnerability has been assigned the CVE...