CVE-2019-3919

The CVE-2019-3919 entry concerns the Alcatel Lucent I-240W-Q GPON ONT with firmware 3FE54567BOZJ19, vulnerable to command injection via a crafted HTTP request to /GponForm/usb_restore_Form?script/. The issue is exploitable by a remote, authenticated attacker and affects the targeted firmware as d...

PT-2019-16774 · Alcatel Lucent · Alcatel Lucent I-240W-Q Gpon Ont

Name of the Vulnerable Software and Affected Versions: Alcatel Lucent I-240W-Q GPON ONT version 3FE54567BOZJ19 Description: The issue allows command injection via crafted HTTP requests sent by a remote, authenticated attacker to the "/GponForm/usb restore Form?script/" endpoint. This enables the...

PT-2019-16772

Name of the Vulnerable Software and Affected Versions Alcatel Lucent I-240W-Q GPON ONT version 3FE54567BOZJ19 Description The issue allows a remote, unauthenticated attacker to enable telnetd on the router via a crafted HTTP request. Recommendations For version 3FE54567BOZJ19, consider disabling...

PT-2019-16776

Name of the Vulnerable Software and Affected Versions Alcatel Lucent I-240W-Q GPON ONT version 3FE54567BOZJ19 Description The issue allows a remote, authenticated attacker to cause a stack buffer overflow via a crafted HTTP POST request sent to the "/GponForm/usb Form?script/" API endpoint. This...

CVE-2019-3920: Improper Neutralization of Special Elements used in an OS Command

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP request sent by a remote, authenticated attacker to /GponForm/deviceForm?script/...

PT-2019-16777

Name of the Vulnerable Software and Affected Versions Alcatel Lucent I-240W-Q GPON ONT version 3FE54567BOZJ19 Description The issue is related to a stack buffer overflow that can be triggered by a crafted HTTP POST request sent to the "/GponForm/fsetup Form" API endpoint by a remote,...

CVE-2019-3921: Stack-based Buffer Overflow

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, authenticated attacker to /GponForm/usbForm?script/. An attacker can leverage this vulnerability to potentially execute arbitrary cod...

CVE-2019-3919: Improper Neutralization of Special Elements used in an OS Command

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent by a remote, authenticated attacker to /GponForm/usbrestoreForm?script/...

CVE-2019-3917: Missing Authentication for Critical Function

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on the router via a crafted HTTP request...

CVE-2019-3918: Use of Hard-coded Credentials

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH interfaces...

CVE-2019-3922: Stack-based Buffer Overflow

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, unauthenticated attacker to /GponForm/fsetupForm. An attacker can leverage this vulnerability to potentially execute arbitrary code...

PT-2019-19712

Name of the Vulnerable Software and Affected Versions FlarumChina version 0.1.0-beta.7C Description The issue is related to SQL injection, which can be triggered via a "/?q=" request. Recommendations For FlarumChina version 0.1.0-beta.7C, update to a newer version that contains a fix for this iss...

CVE-2019-9566: Improper Neutralization of Special Elements used in an SQL Command

FlarumChina v0.1.0-beta.7C has SQL injection via a /?q= request...

Up (Ultimate Plumber) - Tool For Writing Linux Pipes With Instant Live Preview

up is the Ultimate Plumber , a tool for writing Linux pipes in a terminal-based UI interactively, with instant live preview of command results. The main goal of the Ultimate Plumber is to help interactively and incrementally explore textual data in Linux, by making it easier to quickly build...

PT-2019-18728

Name of the Vulnerable Software and Affected Versions MyWebSQL version 3.7 Description The issue allows for Cross-site request forgery CSRF that can be used to delete a database. This can be achieved via the "/?q=wrkfrm&type=databases" API endpoint. Recommendations For MyWebSQL version 3.7,...

CVE-2019-7730: Cross-Site Request Forgery (CSRF)

MyWebSQL 3.7 has a Cross-site request forgery CSRF vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI...

Google Boosts Encryption For Low-End Android Devices

Google introduced a new storage encryption solution that it hopes will expand security efforts across its full spectrum of Android-powered devices – including low-end devices that typically can’t support encryption. The new encryption offering, Adiantum, aims to solve a big issue that has plagued...

CVE-2019-6535

Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet...

CVE-2019-6535

CVE-2019-6535 affects Mitsubishi Electric MELSEC-Q Series PLCs (Q03/04/06/13/26UDVCPU, Q04/06/13/26UDPVCPU with serials ≤20081; Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU with serials ≤20101). A remote attacker can send specific bytes over Port 5007, causing an Ethernet stack crash and disruptio...

Mitsubishi Electric MELSEC-Q Series PLCs

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: MELSEC-Q series PLCs Vulnerability: Resource Exhaustion 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to send...