CVE-2018-12323

An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console...

Cisco AppDynamics App iQ Platform SQL Injection Vulnerability

Cisco AppDynamics App iQ Platform is a real-time application and business performance monitoring solution from Cisco. A SQL injection vulnerability exists in the Enterprise Console in versions prior to Cisco AppDynamics App iQ Platform 4.4.3.10598 HF4. A remote attacker could exploit the...

Unable to Connect Veeam Service Provider Console to Veeam Cloud Connect Server Using a Local Account

Challenge Attempting to connect a Veeam Cloud Connect server through the VSPC web UI using a local account fails with the following error message: Failed to connect to the server. Specified user is invalid or does not have enough permissions on the server. Copy Cause The remote connection was...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

Code injection

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2018-5167

The CVE-2018-5167 issue affects Mozilla Firefox prior to version 60, where the web console and JavaScript debugger fail to sanitize all hyperlink-output. This can cause chrome: and javascript: links to render as active hyperlinks, enabling potential user interaction with internal pages via malici...

Omnibus - Open Source Intelligence Collection, Research, And Artifact Management

An Omnibus is defined as a volume containing several novels or other items previously published separately and that is exactly what the InQuest Omnibus project intends to be for Open Source Intelligence collection, research, and artifact management. By providing an easy to use interactive command...

CVE-2018-0225

The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 HF4 allows SQL injection, aka the Security Advisory 2089 issue...

Sql injection

The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 HF4 allows SQL injection, aka the Security Advisory 2089 issue...

CVE-2018-0225

The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 HF4 allows SQL injection, aka the Security Advisory 2089 issue...

CVE-2018-0225

The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 HF4 allows SQL injection, aka the Security Advisory 2089 issue...

CVE-2018-0225

CVE-2018-0225 concerns the Cisco AppDynamics App iQ Platform Enterprise Console, vulnerable in versions prior to 4.4.3.10598 (HF4). The connected sources specify a SQL injection vulnerability in the Enterprise Console, with a CVSSv3 base score of 9.8 (CRITICAL) and CVSSv2 base score of 7.5 (HIGH)...

DejaVU - Open Source Deception Framework

Deception techniques if deployed well can be very effective for organizations to improve network defense and can be a useful arsenal for blue teams to detect attacks at very early stage of cyber kill chain. But the challenge we have seen is deploying, managing and administering decoys across larg...

Mozilla Firefox Design Vulnerability (CNVD-2018-11791)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 60, which stems from a failure of the web console and JavaScript debugger to filter all output with hyperlinks. A remote...

console-io authentication bypass vulnerability

Cloud Commander is a Web file manager with console and editor. console-io is one of the Web-based console programs. A security vulnerability exists in console-io 2.2.13 and earlier versions, which stems from the program not configuring socket.io to perform authentication. A remote attacker could...

CVE-2016-10615

The CVE-2016-10615 issue affects the curses package, where the library downloads binary resources over HTTP. The underlying problem is insecure HTTP delivery, enabling a MitM attacker to swap the requested binary, potentially leading to remote code execution on the host. The connected advisories ...

CVE-2016-10615

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...