CVE-2020-5805

In Marvell QConvergeConsole GUI

CVE-2020-5804

Summary (CVE-2020-5804) : A path traversal vulnerability affects Marvell QConvergeConsole GUI versions up to 5.5.0.74. The issue lies in the deleteEventLogFile method of the GWTTestServiceImpl class, which validates user-supplied paths insufficiently before performing file deletion. This allows a...

CVE-2020-5805: Cleartext Storage of Sensitive Information

In Marvell QConvergeConsole GUI = 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC...

CVE-2020-5804: Improper Limitation of a Pathname to a Restricted Directory

Marvell QConvergeConsole GUI = 5.5.0.74 is affected by a path traversal vulnerability. The deleteEventLogFile method of the GWTTestServiceImpl class lacks proper validation of a user-supplied path prior to using it in file deletion operations. An authenticated, remote attacker can leverage this...

PT-2021-12475

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole GUI versions 5.5.0.74 and earlier Description: The issue concerns a path traversal vulnerability. Specifically, the deleteEventLogFile method of the GWTTestServiceImpl class lacks proper validation of a user-supplied...

PT-2021-12476

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole GUI versions = 5.5.0.74 Description: The issue concerns the storage of credentials in cleartext within the tomcat-users.xml file. This allows OS-level users on the host, who are not authorized to use QConvergeConsole,...

Marvell QConvergeConsole security vulnerabilities

Marvell QConvergeConsole QCC is a unified adapter management software across data centers from Marvell. The software is primarily used for Ethernet and Fibre Channel adapter management, among other things. A security vulnerability exists in the Marvell QConvergeConsole GUI version 5.5.0.74 and...

My projects that are not related to Information Security: Yennysay TTS and PyTouchOk companion app

Thanks to the long New Year holidays in Russia, I had time to work on my own projects that are not related to information security. I released them on github and recorded short demos by the way, Zoom is quite convenient for this! ?. Yennysay is a GUI text-to-speach tool that uses a free offline T...

Bento - A Minimal Fedora-Based Container For Penetration Tests And CTF With The Sweet Addition Of GUI Applications

A bento 弁当, bentō is a single-portion take-out or home-packed meal of Japanese origin. Bento Toolkit is a simple and minimal docker container for penetration testers and CTF players. It has the portability of Docker with the addition of X, so you can also run GUI application like burp...

CVE-2020-5803

Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root...

Path traversal

Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root...

CVE-2020-5803

CVE-2020-5803 affects Marvell QConvergeConsole GUI 5.5.0.74. It describes a relative path traversal vulnerability that lets a remote, authenticated attacker delete arbitrary files on disk with SYSTEM/root privileges. Exploitation is described as remote and authenticated; no in-wild exploit detail...

PT-2020-18723

Name of the Vulnerable Software and Affected Versions Marvell QConvergeConsole GUI version 5.5.0.74 Description The issue allows a remote, authenticated attacker to delete arbitrary files on disk with elevated privileges, either as SYSTEM or root, due to a Relative Path Traversal vulnerability in...

CVE-2020-5803: Improper Limitation of a Pathname to a Restricted Directory

Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root...

Marvell QConvergeConsole GUI path traversal vulnerability

Marvell QConvergeConsole QCC is a unified adapter management software across data centers from Marvell. The software is primarily used for Ethernet and Fibre Channel adapter management, among other things. A path traversal vulnerability exists in the Marvell QConvergeConsole GUI version 5.5.0.74,...

PT-2020-22895

Уязвимость программного обеспечения для входа в систему GUI fly-qdm связана с отсутствием предупреждения об использовании устаревшего пароля при изменении истекшего пароля. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, получить доступ к конфиденциальным данным...

Foxit Reader Javascript Field fileSelect Use After Free Vulnerability

Summary A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open t...

Xerror - Fully Automated Pentesting Tool

Xerror is an automated penetration tool , which will helps security professionals and non professionals to automate their pentesting tasks. Xerror will perform all tests and, at the end generate two reports for executives and analysts. Xerror provides GUI easy to use menu driven options.Iinternal...

CentOS: Security Advisory for qt5-qtbase (CESA-2020:5021)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

A10 Networks ACOS/aGalaxy GUI RCE (A10-2020-0006)

According to its self-reported version number, the remote A10 appliance is affected by a remote code execution vulnerability in the management Graphical User Interface GUI. An unauthenticated, remote attacker with access to a management interface can exploit this to execute arbitrary code on the...