NethServer 7.3.1611 - Cross-Site Request Forgery (Create User / Enable SSH Access) Vulnerability

Exploit for jsp platform in category web applications HTML Decoded PoC: history.pushState'', '', '/' input type="hidden"...

NethServer 7.3.1611 - Cross-Site Request Forgery (Create User Enable SSH Access)

NethServer 7.3.1611 - Cross-Site Request Forgery Create User Enable SSH Access HTML Decoded PoC: history.pushState'', '', '/' input type="hidden" name="AccountUsercreategrou...

NethServer 7.3.1611 CSRF Create User / Enable SSH Access

HTML Decoded PoC: history.pushState'', '', '/' input type="hidden" name="...

NethServer 7.3.1611 - Cross-Site Request Forgery (Create User / Enable SSH Access)

HTML Decoded PoC: history.pushState'', '', '/' input type="hidden" name="AccountUsercr...

Geneko Routers - Path Traversal

Vulnerability Summary The following advisory describes a Unauthenticated Path Traversal vulnerability found in Geneko GWR routers series. Geneko GWG is compact and cost effective communications solution that provides cellular capabilities for fixed and mobile applications such as data acquisition...

Default credentials

Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key...

Ceragon FibeAir IP-10 7.2.0 Hidden User Backdoor Vulnerability

Exploit for hardware platform in category web applications + Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/160817658078 Vendor: ================= https://www.ceragon.com Products: ====================== Ceragon FibeAir IP-10 =7.2.0 latest version Vulnerabilit...

Ceragon FibeAir IP-10 7.2.0 Hidden User Backdoor

Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/160817658078 Vendor: ================= https://www.ceragon.com Products: ====================== Ceragon FibeAir IP-10 =7.2.0 latest version Vulnerability Types: =================== Hidden User Backdoor...

Debian DLA-938-1 : git security update

Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn 'git upload-pack --help'. For Debian 7 'Wheezy', these problems have been fixed in version 1:1.7.10.4-1+wheezy4. We...

[SECURITY] [DLA 938-1] git security update

Package : git Version : 1:1.7.10.4-1+wheezy4 CVE ID : CVE-2017-8386 Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help". For Debian 7 "Wheezy", these...

Debian Security Advisory DSA 3848-1 (git - security update)

Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn OpenVAS Vulnerability Test $Id: deb3848.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from advisory DSA 3848-1...

Design/Logic Flaw

ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorizedkeys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image...

CVE-2016-1561

ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorizedkeys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image...

CVE-2016-1561

ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorizedkeys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image. Recent assessments: h00die at March 24, 202...

SedSystems D3 Decimator Default Credentials / File Disclosure

SedSystems D3 Decimator Multiple Vulnerabilities ================================================ Identification of the vulnerable device can be performed by scanning for TCP port 9784 which offers a default remote API. When connected to this device it will announce itself with "connected" or...

CVE-2016-10305

Trango Apex = 2.1.1, ApexLynx 2.0, ApexOrion 2.0, ApexPlus = 3.2.0, Giga = 2.6.1, GigaLynx 2.0, GigaOrion 2.0, GigaPlus = 3.2.3, GigaPro = 1.4.1, StrataLink 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software...

CVE-2017-5544

An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout each of the login attempts will occupy a...

Backdoor Vulnerability in Multiple Sony IPELA ENGINE IP Cameras

SNC-CH115, SNC-CH120 and SNC-CH160 are IP camera products from Sony. A backdoor vulnerability exists in multiple Sony IPELA ENGINE IP Cameras. A remote attacker can exploit the vulnerabilities to remotely manage the camera using Telnet/SSH services to gain root access to the Linux shell, affectin...

Eir D1000 Modem CWMP Remote Command Execution

The Eir D1000 Modem has bugs that allow an attacker to gain full control of the modem from the Internet. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

SOL31510510 - OpenSSH vulnerability CVE-2016-6515

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...