The vulnerability of D-Link and TRENDnet’s microprogrammed router services allows attackers to execute arbitrary commands or bypass authentication mechanisms, thereby gaining full control over the device.

The vulnerability of D-Link and TRENDnet’s microprogrammed router software services is related to deficiencies in the authentication process when processing the ping command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pingaddr parameter...

The vulnerability of D-Link and TRENDnet’s microprogrammed router services allows attackers to execute arbitrary commands or bypass authentication mechanisms, thereby gaining full control over the device.

The vulnerability of D-Link and TRENDnet’s microprogrammed router software services is related to deficiencies in the authentication process when processing the ping command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pingaddr parameter...

CVE-2017-10417

Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite subcomponent: Setup and Configuration. Supported versions that are affected are 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network...

[SECURITY] Fedora 27 Update: rawtherapee-5.2-2.fc27

Rawtherapee is a RAW image processing software. It gives full control over many parameters to enhance the raw picture before finally exporting it to some common image format...

Design/Logic Flaw

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload,...

Cisco IOS and IOS XE Software Buffer Overflow Vulnerability

Cisco IOS and IOS XE are both operating systems developed by Cisco for its network devices. Cisco IOS Software/Cisco IOS XE Software has a security vulnerability in the DHCP relay subsystem that allows an unauthenticated, remote attacker to execute arbitrary code and take full control of the...

CVE-2017-1190

IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary code on the system. By manipulating a configurable property, an attacker could exploit this vulnerability to gain full control over the system. IBM X-Force ID:...

Cisco IOS XR Software Incorrect Permissions Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privilege level on an affected system. The vulnerability is due to incorrect permissions that are given to a set of users. An attacker could exploit this...

F5 BIG-IP Default Password Vulnerability

The F5 BIG-IP is a load balancer that uses a variety of distribution algorithms to distribute network requests to available servers in a server cluster, enabling network visitors to have the best possible networking experience by managing incoming Web data traffic and increasing effective network...

Juniper Networks NorthStar Controller Insufficient Authentication Vulnerability

Juniper Networks NorthStar Controller is a powerful and flexible traffic engineering solution that enables granular visualization and control of IP/MPLS flows in carrier networks. A lack of authentication vulnerability exists in Juniper Networks NorthStar Controller, which can be exploited by...

Moxa AWK-3131A Hard-coded Administrator Credentials Vulnerability

Talos Vulnerability Report TALOS-2017-0231 Moxa AWK-3131A Hard-coded Administrator Credentials Vulnerability April 21, 2017 Report ID CVE-2016-8717 Summary An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The devic...

CVE-2017-3834

A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could allow an unauthenticated, remote attacker to take complete control of an affected device. The vulnerability is due to the existence of default credentials for an...

Multiple Vulnerabilities in Dahua IP Camera

Dahua IP Camera is a webcam from Dahua, China. An elevation of privilege and information disclosure vulnerability exists in Dahua IP Camera version 3.200.0001.6. An attacker can exploit this vulnerability by sending a specially crafted request to log into the IP Camera and gain full control of th...

CVE-2017-7253

Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full control of the target IP camera. During exploitation, the fir...

CVE-2016-10305

Trango Apex = 2.1.1, ApexLynx 2.0, ApexOrion 2.0, ApexPlus = 3.2.0, Giga = 2.6.1, GigaLynx 2.0, GigaOrion 2.0, GigaPlus = 3.2.3, GigaPro = 1.4.1, StrataLink 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software...

CVE-2016-10306

Trango Altum AC600 devices have a built-in, hidden root account, with a default password of abcd1234. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it...

CVE-2016-10308

Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the...

CVE-2016-10307

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public but the cleartext value is perhaps not yet public. This account is accessible via SSH and/or TELNET, and...

Multiple Bitdefender Product DLL Load Local Code Injection Vulnerabilities

Bitdefender Total Security and others are antivirus programs from the Romanian company Bitdefender. A local code injection vulnerability exists in multiple Bitdefender products. A local attacker could use this vulnerability to execute arbitrary code in the context of the system running in the...

Multiple Avast Product DLL Load Local Code Injection Vulnerabilities

Avast Pro Antivirus and others are antivirus programs from the Czech company Avast. A local code injection vulnerability exists in several Avast products. A local attacker could use this vulnerability to execute arbitrary code in the context of a system running in an affected program to gain full...