CVE-2018-4020

PfSense CE 2.4.4-RELEASE is affected by three command-injection vulnerabilities in POST handlers of system_advanced_misc.php, via powerd_normal_mode, powerd_ac_mode, and powerd_battery_mode parameters. The root cause is improper sanitization of these POST values, allowing an authenticated attacke...

Vulnerability Spotlight: Netgate pfSense system_advanced_misc.php powerd_normal_mode Command Injection Vulnerability

Brandon Stultz of Cisco Talos discovered these vulnerabilities. Executive summary Today, Cisco Talos is disclosing a command injection vulnerability in Netgate pfSense systemadvancedmisc.php powerdnormalmode. pfSense is a free and open source firewall and router that also features unified threat...

CVE-2018-4019: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

CVE-2018-4020: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

CVE-2018-4021: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

Netgate pfSense system_advanced_misc.php multiple remote command injection vulnerabilities

Summary Three exploitable command injection vulnerabilities exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send...

Netgate Registry Clenaner Local Elevation of Privilege Vulnerability

NETGATE Registry Cleaner is a disk cleaner. A local elevation of privilege vulnerability exists in Netgate Registry Clenaner, which can be exploited by an attacker to elevate privileges...

NETGATE Registry Cleaner 16.0.205 Privilege Escalation

Exploit Title: NETGATE Registry Cleaner Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=4 version : build 16.0.205 Latest Tested on: Windows 7 NETGATE Registry Cleane...

NETGATE Registry Cleaner 16.0.205 - Unquoted Service Path Privilege Escalation

Exploit Title: NETGATE Registry Cleaner Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=4 Version : build 16.0.205 Latest Tested on: Windows 7 NETGATE Registry Cleane...

NETGATE AMITI Antivirus 23.0.305 - Unquoted Service Path Privilege Escalation

NETGATE AMITI Antivirus 23.0.305 - Unquoted Service Path Privilege Escalation Exploit Title: NETGATE AMITI Antivirus Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=1...

NETGATE Data Backup build 3.0.605 - Unquoted Service Path Privilege Escalation

NETGATE Data Backup build 3.0.605 - Unquoted Service Path Privilege Escalation Exploit Title: NETGATE Data Backup Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=5...

NETGATE Data Backup 3.0.605 Privilege Escalation

Exploit Title: NETGATE Data Backup Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=5 version : build 3.0.605 Latest Tested on: Windows 7 NETGATE Data Backup installs ...

NETGATE Data Backup build 3.0.605 - Unquoted Service Path Privilege Escalation

Exploit Title: NETGATE Data Backup Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=5 version : build 3.0.605 Latest Tested on: Windows 7 NETGATE Data Backup installs ...

NETGATE AMITI Antivirus 23.0.305 - Unquoted Service Path Privilege Escalation

Exploit Title: NETGATE AMITI Antivirus Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=11 Version : build 23.0.305 Latest Tested on: Windows 7 AMITI Antivirus install...

NETGATE AMITI Antivirus 23.0.305 Privilege Escalation

Exploit Title: NETGATE AMITI Antivirus Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id=11 version : build 23.0.305 Latest Tested on: Windows 7 AMITI Antivirus install...

NETGATE Registry Cleaner 16.0.205 - Unquoted Service Path Privilege Escalation

NETGATE Registry Cleaner 16.0.205 - Unquoted Service Path Privilege Escalation Exploit Title: NETGATE Registry Cleaner Unquoted Service Path Privilege Escalation Date: 15/10/2016 Author: Amir.ght Vendor Homepage: http://www.netgate.sk/ Software Link: http://www.netgate.sk/download/download.php?id...

Errata: [TZO-2009-1] Avira Antivir - RAR - Division by Zero & Null Pointer Dereference

Errata : Products listed but not affected : AVIRA WebProtector for KEN! - Reason: Does not use the Scan Engine Avira AntiVir Mobile - Reason: Does not use the same AV Engine Avira requested the following products to be removed from the list, for the reason that they are license models and not...