Critical Netgear Bug Impacts Flagship Nighthawk Router

Netgear is warning users of a critical remote code execution bug that could allow an unauthenticated attacker to take control of its Wireless AC Router Nighthawk R7800 hardware running firmware versions prior to 1.0.2.68. The warnings, posted Tuesday, also include two high-severity bugs impacting...

CVE-2019-19383

freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command this is exploitable even if logging is disabled...

CVE-2019-19383

freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command this is exploitable even if logging is disabled...

Buffer overflow

freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command this is exploitable even if logging is disabled...

CVE-2019-19383

Affected software: freeFTPd 1.0.8. The vulnerability is a Post-Authentication Buffer Overflow triggered by a crafted SIZE command, and it is exploitable even when logging is disabled. Root cause described as a buffer overflow due to improper handling of SIZE, allowing control of memory once authe...

CVE-2019-19383

freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command this is exploitable even if logging is disabled...

Session fixation

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal...

CVE-2019-16205

CVE-2019-16205 affects Broadcom/Brocade SANnav prior to version 2.0. The issue is a weak, insufficiently random session ID used for several post-authentication actions in the SANnav portal, enabling remote attackers to brute-force a valid session ID (session hijacking risk). Affected product: SAN...

BSA-2019-864

Security Advisory ID : BSA-2019-864 Component : SANnav portal Revision : 1.0 A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication...

CVE-2019-15715

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution...

CVE-2019-15715

MantisBT (web-based defect tracker) prior to versions 1.3.20 and 2.22.1 is affected by CVE-2019-15715, a Post Authentication Command Injection that leads to Remote Code Execution. The vulnerability requires authentication and can result in high-severity impact (CVE indicates remote code execution...

PT-2019-14339 · Mantisbt · Mantisbt

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 1.3.20 MantisBT versions prior to 2.22.1 Description: The issue allows for Post Authentication Command Injection, which can lead to Remote Code Execution. Recommendations: For versions prior to 1.3.20, update to...

CVE-2019-12104

The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities...

CVE-2019-12104

The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities...

Command injection

The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities...

CVE-2019-12104

The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities...

CVE-2019-14338

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

Design/Logic Flaw

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

CVE-2019-14338

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

CVE-2018-16089

In System Management Module SMM versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user...