PT-2015-6399

Name of the Vulnerable Software and Affected Versions Beckhoff IPC Diagnostics versions prior to 1.8 Description The issue allows remote attackers to cause a denial of service, create arbitrary users, or possibly have other unspecified impacts via a crafted request to the "/upnpisapi" endpoint,...

Beckhoff IPC Diagnositcs Authentication Bypass

Beckhoff IPC diagnostics 1.8 : Authentication bypass ====================================================== CVE number: CVE-2015-4051 Permalink: http://www.thesecurityfactory.be/permalink/beckhoff-authentication-bypass.html Vendor advisory:...

setroubleshoot security update

CentOS Errata and Security Advisory CESA-2015:0729 Updated setroubleshoot packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS...

Command injection

The network diagnostics tool CommandLineServlet in the Appliance Manager command line utility CLU in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command...

CVE-2015-2746

The network diagnostics tool CommandLineServlet in the Appliance Manager command line utility CLU in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command...

CVE-2015-2746

The CVE-2015-2746 entry applies to Websense TRITON AP-WEB 7.8.3 and V-Series appliances (pre-7.8.4 Hotfix 02). The vulnerability is a command-injection in the Appliance Manager CommandLineServlet where remote authenticated users can inject shell metacharacters via the second parameter (demonstrat...

Network Time Protocol Vulnerabilities (Supplement Update A)

OVERVIEW --------- Begin Update A Part 1 of 2 -------- This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-353-01C Network Time Protocol Vulnerabilities that was published February 5, 2015, on the ICS‑CERT web site. --------- End Update A Part 1 of 2 ----------...

IBM Endpoint Manager crossite scripting

Relay Diagnostics crossite scripting...

IBM Endpoint Manager - Persistent Cross-Site Scripting

IBM Endpoint Manager - Persistent Cross-Site Scripting Advisory: Cross-Site Scripting in IBM Endpoint Manager Relay Diagnostics Page During a penetration test, RedTeam Pentesting discovered that the IBM Endpoint Manager Relay Diagnostics page allows anybody to persistently store HTML and JavaScri...

ClearSCADA - Remote Authentication Bypass

ClearSCADA - Remote Authentication Bypass !/usr/bin/python cs-auby.py ClearSCADA Remote Authentication Bypass Exploit Jeremy Brown jbrown3264/gmail Oct 2010 released Jan 2015 There is an authentication bypass vulnerability in ClearSCADA that can be exploited by triggering an exception in...

PT-2014-7305

Name of the Vulnerable Software and Affected Versions Aruba Networks ClearPass versions prior to 6.3.6 Aruba Networks ClearPass versions 6.4.x prior to 6.4.1 Description The issue allows remote attackers to obtain sensitive information, including version numbers and module configuration, by...

CVE-2014-6621: Exposure of Sensitive Information to an Unauthorized Actor

Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not disable the troubleshooting and diagnostics page in production systems, which allows remote attackers to obtain version numbers, module configuration, and other sensitive information by reading the page...

PT-2014-4534

Name of the Vulnerable Software and Affected Versions Cisco RV router firmware versions prior to 1.0.5.9 on RV220W devices Cisco RV router firmware versions prior to 1.0.4.14 on RV180 and RV180W devices Cisco RV router firmware versions prior to 1.0.5.9 on RV120W devices Description The...

CVE-2014-2177: Improper Control of Generation of Code

The network-diagnostics administration interface in the Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote authenticated users to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCuh87126...

CVE-2014-6471

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via vectors related to OAM Diagnostics...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via vectors related to OAM Diagnostics...

CVE-2014-6471

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via vectors related to OAM Diagnostics...

CVE-2014-6471: Undefined Security Weakness

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via vectors related to OAM Diagnostics...

PT-2014-7237

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.0.6, 12.1.3, 12.2.2, 12.2.3, 12.2.4 Description The issue affects the integrity of the system, allowing remote attackers to exploit it via vectors related to OAM Diagnostics in the Oracle Applications Manage...

jenkins: information leak via system diagnostic functionalities (SECURITY-73)

The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump...