PT-2019-15790 · Napc Xinet · Napc Xinet Elegant 6 Asset Library

Name of the Vulnerable Software and Affected Versions: NAPC Xinet Elegant 6 Asset Library version 6.1.655 Description: The issue allows for Pre-Authentication SQL Injection via the "/elegant6/login" API endpoint, specifically through the username field in the LoginForm when double quotes are used...

Xinet Elegant 6 Asset Library Web Interface 6.1.655 SQL Injection

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAPC-XINET-ELEGANT-6-ASSET-LIBRARY-WEB-INTERFACE-PRE-AUTH-SQL-INJECTION.txt + ISR: ApparitionSec Vendor www.napc.com Product Xinet Elegant 6 Asset Library Web Interface v6.1.655 Web based...

DEBIAN-CVE-2019-16905

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing...

CVE-2019-17186

/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...

CVE-2019-17186

/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...

Remote code execution

/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...

CVE-2019-17186

/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...

CVE-2019-17187

/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication Directory Traversal for reading arbitrary files...

CVE-2019-17187

/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication Directory Traversal for reading arbitrary files...

CVE-2019-17187

/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication Directory Traversal for reading arbitrary files...

CVE-2019-13343

Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...

Path traversal

Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...

CVE-2019-13343

CVE-2019-13343 affects Butor Portal prior to 1.0.27 via a path traversal vulnerability in WhiteLabelingServlet. The t parameter is not properly sanitized, allowing a pre-authentication arbitrary file download by constructing a path like /wl?t=../../...&h=. Impact is potential exposure of server f...

CVE-2019-13343

Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...

Exploit for Server-Side Request Forgery in Atlassian Jira_Server

Jira CVE-2019-8451 POC Description Proof of concept scan...

Cisco IOS XE ISDN Data Leakage Vulnerability

Cisco IOS XE is a set of operating systems developed by Cisco for its network devices. A data leakage vulnerability exists in the Dialer interface feature for ISDN connections in Cisco IOS XE for Cisco 4000 Series Integrated Services Routers. The vulnerability stems from insufficient validation o...

CVE-2019-12664

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The...

Exploit for Path Traversal in Ivanti Connect_Secure

CVE-2019-11510-poc Pulse Secure SSL VPN pre-auth file reading...

CloudBees Jenkins Gitlab Authentication Plugin Authorization Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in CloudBees Jenkins Gitlab Authentication Plugin, which can be exploited by an unauthorized attacker to impersonate...

CVE-2019-1226

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction...