The vulnerability of the web interface of the microprogramming software for Cisco RV110W Wireless-N VPN and the multifunctional VPN routers Cisco RV130W Wireless-N and Cisco RV215W Wireless-N VPN allows a hacker to execute arbitrary commands.

The vulnerability of the web interface of Microprogramming Software for Cisco RV110W Wireless-N VPN and Multi-Function VPN Routers such as Cisco RV130W Wireless-N and Cisco RV215W Wireless-N VPN lies in insufficient cleaning of input data used during command generation. Exploiting this...

[ASA-201810-15] xorg-server: privilege escalation

Arch Linux Security Advisory ASA-201810-15 ========================================== Severity: High Date : 2018-10-29 CVE-ID : CVE-2018-14665 Package : xorg-server Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-788 Summary ======= The package xorg-server befor...

CVE-2018-15686

A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and...

Privilege escalation

A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and...

CVE-2018-15686

A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and...

CVE-2018-15686

A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and...

CVE-2018-15686

CVE-2018-15686 affects systemd up to version 239, where unit_deserialize can be manipulated via NotifyAccess to inject arbitrary state across re-execution, potentially enabling root privilege escalation. Exploitation has been demonstrated (e.g., exploit-db link in references). Remediation is to u...

CVE-2018-15686 systemd: reexec state injection: fgets() on overlong lines leads to line splitting

A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and...

CVE-2018-15686

A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and...

Teltonika RUT9XX Missing Access Control To UART Root Terminal Vulnerability

Exploit for cgi platform in category web applications Teltonika RUT9XX Missing Access Control to UART Root Terminal Link: https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-02TeltonikaIncorrectAccessControl Vulnerability Overview Teltonika RUT9XX routers with firmware...

Command injection

A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/netWebCADELETEGetValue URI...

CVE-2018-16282

A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/netWebCADELETEGetValue URI...

CVE-2018-16282

CVE-2018-16282 affects Moxa EDR-810 devices (V4.2 build 18041013). The issue is a command injection in the web server exposed at /xml/net_WebCADELETEGetValue, exploitable by sending a crafted caname value to achieve arbitrary OS commands with root privileges remotely. Multiple sources (NVD entry,...

Input validation

Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150C432 have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to...

Input validation

Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150C432 have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to...

Remote code execution

D-Link EyeOn Baby Monitor DCS-825L 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which provides multiple functions such as changing the passwords and getting basic information, was installed on the device. A remote attacker can send a crafted UDP request to finderd t...

CVE-2017-11563

D-Link EyeOn Baby Monitor DCS-825L 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which provides multiple functions such as changing the passwords and getting basic information, was installed on the device. A remote attacker can send a crafted UDP request to finderd t...

CVE-2017-11563

D-Link EyeOn Baby Monitor DCS-825L 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which provides multiple functions such as changing the passwords and getting basic information, was installed on the device. A remote attacker can send a crafted UDP request to finderd t...

UBUNTU-CVE-2017-7500

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory ...

DEBIAN-CVE-2017-7500

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory ...