NOKIA VitalSuite SPM 2020 SQL Injection

Exploit Title: NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection Exploit Author: Berk Dusunur Google Dork: N/A Type: Web App Date: 2020-05-28 Vendor Homepage: https://www.nokia.com Software Link: https://www.nokia.com/networks/products/vitalsuite-performance-management-software/ Affected...

CVE-2020-5364

Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community string. This community string allows read-only access to many aspects of the Isilon cluster, some of which are considered sensitive and can...

kernel: use-after-free in function __mdiobus_register() in drivers/net/phy/mdio_bus.c

A use-after-free flaw was found in the Linux kernel's MDIO section of the network management subsystem. An attacker who is able to hot-plug a network device can trigger the mdiobusregister function in drivers/net/phy/mdiobus.c, which can cause a use-after-free condition causing a memory corruptio...

CVE-2019-19108

An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP...

The vulnerability of Siemens SINEMA Server software for network management and configuration allows a perpetrator to compromise the confidentiality, integrity, and accessibility of vulnerable systems and basic components.

The vulnerability of Siemens SINEMA Server network management and configuration software is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to remotely compromise the confidentiality, integrity, and accessibility of the vulnerable system and its...

CVE-2020-10603

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

Advantech WebAccess/NMS SQL Injection Vulnerability (CNVD-2020-22315)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A SQL injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by attackers to obtain sensitive information...

Synergy Systems & Solutions HUSKY RTU 6049-E70 Access Control Error Vulnerability (CNVD-2020-25373)

Synergy Systems & Solutions HUSKY RTU 6049-E70 is a Remote Terminal Unit RTU from Synergy Systems & Solutions, India. The Synergy Systems & Solutions HUSKY RTU 6049-E70 is vulnerable to an access control error that can be exploited by an attacker to view the network configuration via SNMP...

Advantech WebAccess/NMS File Upload Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A file upload vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker to upload arbitrary files...

Advantech WebAccess/NMS SQL Injection Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A SQL injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2. An attacker could exploit this vulnerability to gain access to sensitive information...

Advantech WebAccess/NMS Operating System Command Injection Vulnerability

Advantech WebAccess/NMS is a Web browser-based Network Management System NMS software package from Advantech, Taiwan, China. An operating system command injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which stems from the program failing to clean up user input. ...

Advantech WebAccess/NMS Path Traversal Vulnerability (CNVD-2020-22313)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...

Moderate: Red Hat Bug Fix Advisory: net-snmp bug fix and enhancement update

An update for net-snmp is now available for Red Hat Enterprise Linux 8. The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol SNMP, including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools fo...

Nsauditor 3.2.0.0 - (Name) Denial of Service Exploit

Exploit Title: Nsauditor 3.2.0.0 - 'Name' Denial of Service PoC Discovery by: 0xMoHassan Date: 2020-04-04 Vendor Homepage: http://www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/nsauditorsetup.exe Tested Version: 3.2.0.0 Vulnerability Type: Denial of Service DoS Local Tested o...

net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service

snmpoidcompare in snmplib/snmpapi.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service...

NETSAS Enigma NMS Directory Traversal Vulnerability

NETSAS Enigma NMS is a suite of network management and monitoring tools from NETSAS Australia. A path traversal vulnerability exists in NETSAS Enigma NMS version 65.0.0 and earlier. The vulnerability stems from the failure of a network system or product to properly filter special elements in the...

CVE-2019-16069

A number of stored Cross-site Scripting XSS vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through the SNMP protocol...

CVE-2019-16061

A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing any low privileged user with access to the system to read sensitive data e.g., .htpasswd and create/modify/delete content e.g., under /var/www/html/docs with...

Cisco Warns of High-Severity SD-WAN Flaws

Cisco Systems has fixed three high-severity vulnerabilities in its software-defined networking for wide-area network SD-WAN solutions for business users. If exploited, the flaws could enable bad actors to execute commands with root privileges on affected systems. To exploit the vulnerabilities...