Exploit for Improper Authentication in Comodo Unified_Threat_Management_Firewall

CVE-2018-17431-PoC Proof of consept for CVE-2018-17431 E...

CVE-2018-7066

An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the...

CVE-2018-7066

An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the...

CVE-2018-7066

An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the...

CVE-2018-7066

CVE-2018-7066 describes an unauthenticated remote command execution in Aruba ClearPass Policy Manager via the OnConnect feature. A defect in the API used to link other network devices (configuration under CLI Settings for linked devices) could allow a remote attacker to execute arbitrary commands...

The vulnerability of the Microsoft Team Foundation Server software, related to errors in the authentication process, allows a violator to execute arbitrary commands.

The vulnerability of the Microsoft Team Foundation Server TFS exists due to the lack of basic authentication when exchanging data between the software platform and the search service. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Cross site request forgery (csrf)

FreeSWITCH through 1.8.2, when modxmlrpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system or api/bgsystem or txtapi/bgsystem query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF...

CVE-2018-19911

FreeSWITCH through 1.8.2, when modxmlrpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system or api/bgsystem or txtapi/bgsystem query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF...

CVE-2018-19911

FreeSWITCH through 1.8.2, when modxmlrpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system or api/bgsystem or txtapi/bgsystem query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF...

CVE-2018-19911

FreeSWITCH up to 1.8.2 with mod_xml_rpc enabled is vulnerable to remote command execution via the api/system/txtapi/system endpoints on TCP port 8080 (example: api/system?calc). The issue can also be exploited via CSRF, and in some cases the freeswitch account’s default password may be usable. Th...

Nagios XI Snoopy Unauthorized Remote Command Execution Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from Nagios, USA. The solution supports monitoring and alerting of applications, services, operating systems, etc. Snoopy is one of the PHP classes that emulates a Web browser. A security vulnerability exists in Snoopy version 1.0 in...

Fleetco Fleet Maintenance Management 1.2 Remote Code Execution

Exploit Title: Fleetco Fleet Maintenance Management 1.2 - Remote Code Execution Date: 2018-11-23 Exploit Author: Azkan Mustafa AkkuA AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.fleetco.space Software Link: http://www.fleetco.space/download/215/ Version: v1.2 Category: Webap...

Drobo 5N2 Improper Access Control Vulnerability

Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device has features such as data sharing, data backup, remote access and disaster recovery.Dashboard API is one of the dashboard components. An improper access control vulnerability exists in the Dashboard API in Drobo 5N2 NA...

jiacrontab command execution vulnerability

jiacrontab is a timed task management tool with visualization support. A security vulnerability exists in the crontab/task/edit?addr=localhost%3a2000 page in jiacrontab version 1.4.5. A remote attacker can exploit this vulnerability to execute arbitrary commands with the help of 'command' and...

Remote Command Execution Vulnerability in RG-AC128

The RG-AC128 is a wireless controller for the new generation of high-speed wireless networks launched by Ruijie Networks. A remote command execution vulnerability exists in the RG-AC128. An attacker can exploit this vulnerability to execute commands...

VMware vSphere Data Protection 6.0.x < 6.0.9 / 6.1.x < 6.1.10 Multiple Vulnerabilities (VMSA-2018-0029)

The version of VMware vSphere Data Protection installed on the remote host is 6.0.x 6.0.9 and 6.1.x 6.1.10. It is, therefore, affected by the following vulnerabilities: - A remote command execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and...

ZyXEL NSA325 V2 Command Injection Vulnerability

The ZyXEL NSA325 V2 is a network storage device from Hopkins ZyXEL Technology. A command injection vulnerability exists in the zyshclient proprietary command line interface in the ZyXEL NSA325 V2 version 4.81, which can be exploited by an attacker to execute system commands with the help of this...

Netgear Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netgear Devices Unauthenticated Remote Command Execution', 'Description' = %q From the CVE-2016-1555 page: 1 boardData102.php, 2 boardData103.php...

Netgear Unauthenticated Remote Command Execution Exploit

Netgear WN604 versions before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 versions before 3.5.5.0 allow remote attackers to execute arbitrary commands. This module requires Metasploit: https://metasploit.com/download Current source:...

CMS Made Simple Remote Code Execution (CVE-2018-10517)

A remote command execution vulnerability exists in CMS Made Simple 2.2.7. By uploading an XML Package that contain base64-encoded PHP code in a data element, an authenticated attacker with administrator privileges can exploit this vulnerability for execution of arbitrary code...