Huawei HG532 routers contain a path traversal vulnerability

Overview Huawei HG532 routers, including the HG532e, n, s, and possibly other models, are vulnerable to arbitrary file access through path traversal. Description CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' - CVE-2015-7254In vulnerable Huawei router models,...

Commvault Edge Server deserializes cookie data insecurely

Overview Commvault Edge Server, version 10 R2, deserializes untrusted, user-provided cookie data, resulting in arbitrary OS command execution with the web server's privileges. Description CWE-502: Deserialization of Untrusted Data - CVE-2015-7253Commvault Edge Server, version 10 R2, deserializes...

SOL17515 - NTP vulnerability CVE-2015-7855

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL17517 - NTP vulnerability CVE-2015-7701

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

JVN#68289108: Enisys Gw fails to restrict access permissions

Enisys Gw provided by Techno Project Japan Co. is an open source groupware. Enisys Gw fails to restrict access permissions. Impact A remote unauthenticated attacker may be access to an arbitrary file uploaded on the product. Solution Update the Software Update to the latest version according to t...

Qolsys IQ Panel contains multiple vulnerabilities

Overview All firmware versions of Qolsys IQ Panel contain hard-coded cryptographic keys, do not validate signatures during software updates, and use a vulnerable version of Android OS. Description Qolsys IQ Panel is an Android OS-based touch screen controller for home automation devices and...

SOL17494 - PAM vulnerability CVE-2015-3238

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Bluefish 2.2.7 - Denial Of Service Vulnerability

Exploit for linux platform in category dos / poc ----------------------------------------------------- Exploit Title : bluefish - Denial Of Service Vulnerability Date : 02/10/2015 Exploit Author : ZwX Software Vendor : http://bluefish.openoffice.nl/index.html Software Link:...

PT-2016-3297 · Gnu +3 · Gnu Tar +3

Name of the Vulnerable Software and Affected Versions: GNU tar versions 1.14 through 1.29 Description: The issue is related to a directory traversal vulnerability in the safer name suffix function. This vulnerability might allow remote attackers to bypass an intended protection mechanism and writ...

SOL17331 - PCRE library vulnerability CVE-2015-5073

Recommended Action If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are currently...

Code injection

Unit4 Polska TETA Web formerly TETA Galactica 22.62.3.4 does not properly restrict access to the 1 Design Mode and 2 Debug Logger mode modules, which allows remote attackers to gain privileges via crafted "received parameters."...

SOL17263 - OpenSSH vulnerabilities CVE-2015-6563 and CVE-2015-6564

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

SOL17241 - Linux kernel vulnerability CVE-2014-9585

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can...

Page Restrict <= 2.2.1 - Authenticated Stored Cross-Site Scripting (XSS)

The Page Restrict WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

WordPress Page Restrict Plugin <= 2.2.1 - Stored Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

Sierra Wireless GX, ES, and LS gateways running ALEOS contain hard-coded credentials

Overview Sierra Wireless GX, ES, and LS gateway devices running ALEOS versions 4.4.1 and earlier contain hard-coded credentials. Description CWE-259: Use of Hard-coded Password - CVE-2015-2897Sierra Wireless GX, ES, and LS gateways running ALEOS contain multiple hard-coded accounts with root...

OracleVM 3.3 : ntp (OVMSA-2015-0102)

The remote OracleVM system is missing necessary patches to address critical security updates : - reject packets without MAC when authentication is enabled CVE-2015-1798 - protect symmetric associations with symmetric key against DoS attack CVE-2015-1799 - fix generation of MD5 keys with ntp-keyge...

SOL16909 - BIND vulnerability CVE-2015-5477

1These versions are vulnerable if a self IP address or management IP address is configured to allow inbound connections on port 53. 2These versions are vulnerable if a DNS profile is configured with the Use BIND Server on BIG-IP option enabled by default. 3These versions are vulnerable if...

PT-2017-6632 · Red Hat +1 · Openjdk-8 +2

Name of the Vulnerable Software and Affected Versions: OpenJDK8 versions as packaged in Red Hat Enterprise Linux 6 and 7 Description: The issue allows local users to write to arbitrary files via a symlink attack on the Hotspot component. Recommendations: For OpenJDK8 versions as packaged in Red H...

SOL16826 - PHP vulnerability CVE-2015-4024

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...