4705 matches found
Design/Logic Flaw
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/EmbededAceTLSetTask.cgi is a very similar endpoint that is designed for use with setting table values th...
CVE-2018-4073
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/EmbededAceTLSetTask.cgi is a very similar endpoint that is designed for use with setting table values th...
Information Disclosure
serve-handler is vulnerable to information disclosure attacks. The vulnerability exists as symlinks were enabled by default, and were being resolved during runtime...
PT-2019-10800
Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description A Permission Assignment issue exists in the ACEManager EmbeddedAceSet Task.cgi functionality. The endpoint "/cgi-bin/Embeded Ace TLSet Task.cgi" allows for arbitrary setting writes,...
CVE-2018-4073: Incorrect Permission Assignment for Critical Resource
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/EmbededAceTLSetTask.cgi is a very similar endpoint that is designed for use with setting table values th...
CVE-2017-18372
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the toolstime.asp page and can be exploited through the...
Command injection
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the toolstime.asp page and can be exploited through the...
CVE-2017-18372
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the toolstime.asp page and can be exploited through the...
CVE-2017-18372
CVE-2017-18372 affects the Billion 5200W-T TCLinux FW 7.3.8.0 v008 130603 router distributed by TrueOnline. The vulnerability is a command injection in the Time Setting function via tools_time.asp, exploitable through uiViewSNTPServer and requires an authenticated user. Authentication can be achi...
Improper Access Control
Oracle MySQL is vulnerable to improper access control. MySQL init script mishandles initialization of the database data directory and permission setting on the error log file allowing local attackers to escalate their privileges to root or cause a system crash...
CVE-2017-18372: Improper Neutralization of Special Elements used in an OS Command
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the toolstime.asp page and can be exploited through the...
F5 Networks BIG-IP : HTTP/2 ALPN vulnerability (K94563344)
The Traffic Management Microkernel TMMmay restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation ALPNenabled and it processes traffic where the ALPN extension size is zero.CVE-2019-6619 Impact BIG-IP The Traffic Management Microkernel TMM generates a core...
Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Set_Task.cgi Permission Assignment Vulnerability
Summary An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a arbitrary setting writes, resulting in the unverified changes to any system setting. An...
Memory Corruption Vulnerability in dp2 Project File of Xinjie OP20 Screen Setting Tool
Wuxi Xinjie Electric Co., Ltd. is a well-known domestic enterprise focusing on the research, development and application of industrial automation products. A memory corruption vulnerability exists in the dp2 project file of the Xinjie OP20 screen setup tool, which can be exploited by attackers to...
CVE-2018-17287
In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...
CVE-2019-11228
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...
Design/Logic Flaw
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...
CVE-2019-0683
An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...
CVE-2018-1680
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 145236...
X (Formerly Twitter): Protected Tweets setting overridden by Android app
Summary: Protected Tweets setting overridden by Android app Description: The Android app overrides the "Protect your Tweets" setting set from outside the app in some cases when changing other settings. Steps To Reproduce: 1. Log in to an account with unprotected tweets on the Android app. 1. Log ...