Cisco Small Business RV132W and RV134W Routers Management Interface Remote Command Execution and Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly. The...

Server-Side Request Forgery (SSRF)

akeneo/pim-community-dev is vulnerable to server-side request forgery SSRF. Unhandled redirections on the event subscription URLs allow attackers to send arbitrary HTTP requests on behalf of the server...

PT-2021-2425

Name of the Vulnerable Software and Affected Versions: Cisco RV132W ADSL2+ Wireless-N VPN Routers affected versions not specified Cisco RV134W VDSL2 Wireless-AC VPN Routers affected versions not specified Description: A vulnerability in the web-based management interface of the affected devices...

USN-4442-2 sympa vulnerabilities

USN-4442-1 fixed vulnerabilities in Sympa. This update provides the corresponding updates for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. Original advisory details: Nicolas Chatelain discovered that Sympa incorrectly handled environment variables. An attacker could possibly use this...

USN-4442-2: Sympa vulnerabilities

USN-4442-1 fixed vulnerabilities in Sympa. This update provides the corresponding updates for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. Original advisory details: Nicolas Chatelain discovered that Sympa incorrectly handled environment variables. An attacker could possibly use this...

USN-4796-1: Node.js vulnerabilities

Alexander Minozhenko and James Bunton discovered that Node.js did not properly handle wildcards in name fields of X.509 TLS certificates. An attacker could use this vulnerability to execute a machine-in-the-middle- attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. CVE-2016-7099 It...

CVE-2020-19417

Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users such as the default account 'maint' to perform administrative tasks by sending specially crafted HTTP requests to the application...

Default credentials

Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users such as the default account 'maint' to perform administrative tasks by sending specially crafted HTTP requests to the application...

Cross site request forgery (csrf)

The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed by omitting the CSRF token parameter in HTTP requests...

CVE-2020-19417

Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users such as the default account 'maint' to perform administrative tasks by sending specially crafted HTTP requests to the application...

CVE-2020-19417

CVE-2020-19417 affects Emerson Smart Wireless Gateway 1420 firmware 4.6.59. The issue lets non-privileged users (e.g., default account ‘maint’) perform administrative tasks by sending specially crafted HTTP requests to the application, enabling horizontal escalation on the device via the network....

FIN8 Hackers Return With More Powerful Version of BADHATCH PoS Malware

Threat actors known for keeping a low profile do so by ceasing operations for prolonged periods in between to evade attracting any attention as well as constantly refining their toolsets to fly below the radar of many detection technologies. One such group is FIN8, a financially motivated threat...

PT-2021-10346

Name of the Vulnerable Software and Affected Versions: Emerson Smart Wireless Gateway 1420 version 4.6.59 Description: The issue allows non-privileged users, such as the default account maint, to perform administrative tasks by sending specially crafted HTTP requests to the application...

CVE-2020-19417: Undefined Security Weakness

Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users such as the default account 'maint' to perform administrative tasks by sending specially crafted HTTP requests to the application...

Netgear NETGEAR JGS516PE has a cross-site request forgeing vulnerability

The Netgear NETGEAR JGS516PE is a switch from Netgear, Inc. The NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 suffers from a cross-site request forgery vulnerability that stems from a CSRF protection mechanism implemented in the web management panel that can be bypassed by omitting the CSRF token parameter...

NewStart CGSL MAIN 6.02 : openwsman Vulnerability (NS-SA-2021-0084)

The remote NewStart CGSL host, running version MAIN 6.02, has openwsman packages installed that are affected by a vulnerability: - Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in processconnection when parsing specially crafted HTTP requests. A remote,...

NewStart CGSL CORE 5.04 / MAIN 5.04 : openwsman Vulnerability (NS-SA-2021-0029)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openwsman packages installed that are affected by a vulnerability: - Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in processconnection when parsing specially crafted HTTP requests. A remote...

Emerson Smart Wireless Gateway 1420 4.6.59 Privilege Escalation Vulnerability

Title: Privilege Escalation Product: Emerson Smart Wireless Gateway Vendor Homepage: http://emerson.com Vulnerable Version: 1420 4.6.59 CVE Number: CVE-2020-19417 Authors: Harsha Bhat Anish Mitra and Unmesh Guragol Timeline: 2019-08-02 Disclosed to the vendor 2019-08-22 Vendor confirmed that the...

Emerson Smart Wireless Gateway 1420 4.6.59 Privilege Escalation

Title: Privilege Escalation Product: Emerson Smart Wireless Gateway Vendor Homepage: http://emerson.com Vulnerable Version: 1420 4.6.59 CVE Number: CVE-2020-19417 Authors: Harsha Bhat Anish Mitra and Unmesh Guragol Timeline: 2019-08-02 Disclosed to the vendor 2019-08-22 Vendor confirmed that the...

Zoho ManageEngine ADSelfService Plus跨站脚本漏洞

ZOHO ManageEngine ADSelfService Plus, an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, is vulnerable to cross-site scripting. A cross-site scripting vulnerability exists in Zoho ManageEngine ADSelfService Plus, which...