KONE KGC 4.6.4 - Multiple Vulnerabilities

KONE KGC versions 4.6.4 and below suffer from unauthenticated remote code execution, denial of service, local file inclusion, and missing FTP access control vulnerabilities. Vulnerabilities in KONEs Group Controller KGC -------------------------------------------------------------------------...

[SECURITY] [DSA 4285-1] sympa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4285-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 05, 2018 https://www.debian.org/security/faq -...

HPE Moonshot Provisioning Manager Local Arbitrary File Modification Vulnerability

HPE Moonshot Provisioning Manager is an application for managing HPE Moonshot systems from Hewlett Packard Enterprise HPE. A local arbitrary file modification vulnerability exists in HPE Moonshot Provisioning Manager versions prior to 1.24, which can be exploited by a local attacker to modify...

CVE-2018-7073

A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24...

CVE-2018-7073

A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24...

Design/Logic Flaw

A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24...

CVE-2018-7073

A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24...

CVE-2018-7073

CVE-2018-7073 affects HPE Moonshot Provisioning Manager prior to v1.24. It is a local arbitrary file modification vulnerability in the provisioning manager (component: Moonshot Provisioning Manager) where a local attacker could modify arbitrary files. CVSS shows base score 5.5 (Medium) with local...

CVE-2018-7073: Exposure of Resource to Wrong Sphere

A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24...

CVE-2017-3209

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

CVE-2018-10604

SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution...

SEL Compass Elevation of Privilege Vulnerability

SEL Compass is an application for managing and updating SEL products from Schweitzer Engineering Laboratories SEL, USA. An elevation of privilege vulnerability exists in SEL Compass 3.0.5.1 and earlier versions, which arises from the program failing to properly set access rights and can be...

CVE-2018-2437

The SAP Internet Graphics Service IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions which can lead to: disclosure of information and malicious file insertion or modification...

Schweitzer Engineering Laboratories, Inc. Compass and AcSELerator Architect

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/Low skill level to exploit/Public exploits are available for these vulnerabilities Vendor: Schweitzer Engineering Laboratories, Inc. SEL Equipment: Compass and AcSELerator Architect Vulnerabilities: Incorrect Default Permissions,...

CVE-2017-18226

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...

DEBIAN-CVE-2018-1000550

The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This...

CVE-2018-1000550: Improper Limitation of a Pathname to a Restricted Directory

The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This...

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18284: Incorrect Permission Assignment for Critical Resource

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2018-8841

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an improper privilege management vulnerability may allow an authenticated...