371 matches found
CVE-2018-15483
An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04...
CVE-2018-15484
The CVE-2018-15484 entry affects KONE Group Controller (KGC) devices prior to 4.6.5. The issue allows unauthenticated remote code execution via the open HTTP interface by modifying autoexec.bat (aka KONE-01). Impact is high: attacker can achieve remote code execution with network access and no pr...
PT-2018-13052
Name of the Vulnerable Software and Affected Versions KONE Group Controller KGC versions prior to 4.6.5 Description An issue allows unauthenticated Local File Inclusion and File modification through the open HTTP interface. This can be achieved by modifying the name parameter of the file endpoint...
PT-2018-13049
Name of the Vulnerable Software and Affected Versions KONE Group Controller KGC versions prior to 4.6.5 Description An issue was discovered that allows Denial of Service to occur through the open HTTP interface. Recommendations For versions prior to 4.6.5, update to version 4.6.5 or later to...
PT-2018-13050
Name of the Vulnerable Software and Affected Versions KONE Group Controller KGC versions prior to 4.6.5 Description An issue allows unauthenticated remote code execution through the open HTTP interface by modifying autoexec.bat. Recommendations For versions prior to 4.6.5, update to version 4.6.5...
CVE-2018-15486: Inclusion of Functionality from Untrusted Control Sphere
An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02...
CVE-2018-15484: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec.bat, aka KONE-01...
CVE-2018-15483: Improper Input Validation
An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04...
UBUNTU-CVE-2018-11769
CouchDB administrative users before 2.2.0 can configure the database server via HTTPS. Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's...
Design/Logic Flaw
A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary code with vmanage user privileges or cause a denial of service DoS condition on an affected system. The vulnerability is due to insufficient...
PT-2018-1851
Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD Software affected versions not specified Description The issue is related to insufficient validation of HTTP requests in the web interface of the Cisco Adaptive...
Ladon Framework For Python 0.9.40 XXE Injection
Advisory: XML External Entity Expansion in Ladon Webservice Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service...
Ladon Framework For Python 0.9.40 XXE Injection Vulnerability
Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service with exponentially growing memory payloads. Versions 0.9.40...
Wireless IP Camera (P2P) WIFICAM GoAhead Backdoor / Remote Command Execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: Multiple vulnerabilities found in Wireless IP Camera P2P WIFICAM cameras and vulnerabilities in GoAhead Advisory URL: https://pierrekim.github.io/advisories/2017-goahead-camera-0x00.txt Blog URL:...
TP-Link C2 and C20i Command Injection Vulnerability
TP-Link is a Chinese manufacturer of network equipment such as routers and IOT devices. A command injection vulnerability exists in the http management interface of the TP-Link C2 and C20i. An attacker can exploit this vulnerability to inject arbitrary shell commands and gain root privileges...
CVE-2016-6461
A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to inject arbitrary XML commands on the affected system. More Information: CSCva38556. Known Affected Releases: 9.16.10. Known Fixed Releases:...
PT-2016-6933 · Cisco · Cisco Asa
Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA version 9.16.10 Description: A vulnerability in the HTTP web-based management interface could allow an unauthenticated, remote attacker to inject arbitrary XML commands on the affected system...
Sonatype Nexus Repository Manager Java Object Deserialization RCE
The Sonatype Nexus Repository Manager server application running on the remote host is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated, remote attacker can exploit...
Red Hat JBoss Operations Network Java Object Deserialization RCE
The remote Red Hat JBoss Operations Network server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Jython library. An unauthenticated, remote attacker can exploit this, by sending specially crafted Java objects to the HTT...