Juniper SRX Series Junos OS Denial of Service Vulnerability

Juniper SRX Series is an SRX Series firewall appliance from Juniper Networks, Inc. Junos OS is the operating system that runs on it. A security vulnerability exists in Junos OS versions 12.1X46, 12.3X48, and 15.1X49 on the Juniper SRX Series. An attacker could exploit this vulnerability with...

CVE-2018-0631

Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter...

Command injection

TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the startarpping function of the timer binary, which allows remote attackers to execute arbitrary commands via three parameters dhcpdstart, dhcpdend, and lanipaddr passed to the apply.cgi binary through a POST...

CVE-2018-17532

Teltonika RUT9XX routers with firmware before 00.04.233 are affected by CVE-2018-17532, a set of unauthenticated OS command-injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient input sanitization. Successful exploitation allows remote command execution with root pri...

Cross-Site Scripting (XSS) in GlobalProtect Portal Login Page

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS GlobalProtect Portal Login page. Ref. PAN-99830; CVE-2018-10141 Successful exploitation of this issue may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. This issue affects PAN-OS 8.1.3 and earlier. PAN-OS 8.0...

Junos OS: jdhcpd process crash during processing of specially crafted DHCPv6 message

Receipt of a specially crafted DHCPv6 message destined to a Junos OS device configured as a DHCP server in a Broadband Edge BBE environment may result in a jdhcpd daemon crash. The daemon automatically restarts without intervention, but a continuous receipt of crafted DHCPv6 packets could leaded ...

Cross-Site Scripting (XSS) in GlobalProtect Gateway

A Cross-Site Scripting XSS vulnerability exists in a PAN-OS response for GlobalProtect Gateway. Ref. PAN-84836; CVE-2018-10139 Successful exploitation of this issue may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. This issue affects PAN-OS 6.1.21 and earlier, PAN-OS...

Operating System-Specific Mitigations address L1 Terminal Fault - OS vulnerability in VMware Virtual Appliances.

VMware Virtual Appliance Mitigations address L1 Terminal Fault - OS vulnerability. Successful exploitation of this issue may lead to local information disclosure of sensitive information. Unaffected products lines are documented in KB55807. The Common Vulnerabilities and Exposures project...

VMSA-2018-0021:Operating System-Specific Mitigations address L1 Terminal Fault - OS vulnerability in VMware Virtual Appliances.

VMSA-2018-0021.2 Operating System-Specific Mitigations address L1 Terminal Fault - OS vulnerability in VMware Virtual Appliances. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0021.2 VMware Security Advisory Severity: Moderate VMware Security Advisory Synopsis: Operatin...

CVE-2018-8870

CVE-2018-8870 affects Medtronic MyCareLink Monitors (models 24950 and 24952). The vulnerability is a hard-coded operating system password, enabling a physically proximate attacker who can open the device and connect via a debug port to gain privileged OS access. The ICS-CERT advisory corroborates...

Command injection

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability both on the server and on devices by sending malformed parameters in sensor or...

Security Bulletin: Open Source GNU glibc Vulnerabilities which is used by IBM OS Images for RedHat Linux in IBM PureApplication Systems (CVE-2017-1000366)

Summary There are vulnerabilities in the Open Source GNU glibc that is used by the OS Images for IBM PureApplication Software Suite, IBM Bluemix Local System and IBM PureApplication System/Software Vulnerability Details CVEID: CVE-2017-1000366 DESCRIPTION: Glibc could allow a local attacker to...

CVE-2018-10730

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection...

Major OS Players Misinterpret Intel Docs, and Now Kernels Can Be Hijacked

Multiple operating system vendors issued coordinated patches this week to address a common vulnerability across their platforms, which was introduced thanks to widespread misinterpretation of Intel developer documentation. According to the CERT/CC team, most major players including Apple, FreeBSD...

Design/Logic Flaw

Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

Lenovo Patches Networking OS Vulnerability Dating Back to 2004

Lenovo patched a flaw in its networking operating system dating back to 2004 that allowed attackers to perform an authentication bypass attack via a mechanism called “HP Backdoor.” If exploited, an attacker could gain admin-level access on affected switches, Lenovo said. The vulnerability is rate...

ROBOT attack against PAN-OS

ROBOT is an attack that affects the TLS RSA key exchange and could lead to decryption of captured sessions if the TLS server originally serving said captured session is still alive, vulnerable and using the same private key. PAN-89936 / CVE-2017-17841 While SSL Decryption and GlobalProtect are...

Cross Site Scripting Vulnerability in PAN-OS GlobalProtect

A vulnerability exists in PAN-OS GlobalProtect when either the gateway or the portal are configured. This issue could allow for a cross-site scripting XSS attack. Ref PAN-81586 / CVE-2017-15941 Successful exploitation of this issue may allow an attacker to inject arbitrary javascript or HTML. Thi...

ROBOT attack against PAN-OS

ROBOT is an attack that affects the TLS RSA key exchange and could lead to decryption of captured sessions if the TLS server originally serving said captured session is still alive, vulnerable and using the same private key. PAN-89936 / CVE-2017-17841 While SSL Decryption and GlobalProtect are...

Cambium ePMP1000 'get_chart' Shell via Command Injection (v3.1-3.5-RC7)

This module exploits an OS Command Injection vulnerability in Cambium ePMP1000 device management portal. It requires any one of the following login credentials - admin/admin, installer/installer, home/home - to set up a reverse netcat shell. The module has been tested on versions 3.1-3.5-RC7...