CVE-2018-12338

Undocumented Factory Backdoor in ECOS System Management Appliance aka SMA 5.2.68 allows the vendor to extract confidential information and manipulate security relevant configurations via remote root SSH access...

Improper access control

Incorrect access control in ECOS System Management Appliance aka SMA 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment...

CVE-2018-12338

ECOS SMA 5.2.68 is affected by an undocumented vendor backdoor that enables extraction of confidential information and manipulation of security configurations via remote root SSH access. The issue is described consistently across multiple records (NVD CVE-2018-12338 and related CNVD/PRION entries...

CVE-2018-12335

CVE-2018-12335 affects ECOS System Management Appliance (SMA) 5.2.68. Root cause: improper access control allowing unrestricted database access during Easy Enrollment. Consequence: an attacker could compromise authentication keys and access/manipulate security-related configurations. Public detai...

CVE-2018-12335

Incorrect access control in ECOS System Management Appliance aka SMA 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment...

CVE-2018-12331

The CVE-2018-12331 entry concerns ECOS System Management Appliance (SMA) v5.2.68. Affected component: SMA authentication during Easy Enrollment. Root cause: authentication bypass via IP spoofing enabling a man-in-the-middle to access activation codes, passwords, and configurations. Documented imp...

Cross site scripting

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 is vulnerable to Cross‑Site Scripting via the site name parameter on adm1n/admin_config.php (system management page). The root cause is an XSS flaw in the site name input; impact is user‑visible script injection. The connected records confirm the vulnerability across multiple sources...

Ecos Secure Boot Stick 5.6.5 Credential Disclosure / Information Leak

MULTIPLE SECURITY ISSUES IN ECOS SECURE BOOT STICK SBS - Software: Ecos Secure Boot Stick - Version: Stick Version 5.6.5, System Management Version 5.2.68 - Vendor Status: Vendor informed - Release Date: 13/06/2018 The latest version of this document may be downloaded from...

[SECURITY] Fedora 27 Update: ruby-2.4.4-89.fc27

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

Quest KACE System Management Appliance Command Injection Vulnerability (CNVD-2018-10906)

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A command injection vulnerability exists in Quest KACE System Management Appliance version 8.0.318. An attacker can use this vulnerability to inject arbitrary commands and execute them with root...

Input validation

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...

Quest KACE System Management Virtual Appliance Path Traversal Vulnerability

Quest KACE System Management Virtual Appliance is an IT asset management appliance from Quest Software, USA. A path traversal vulnerability exists in Quest KACE System Management Virtual Appliance version 8.0.318. The vulnerability can be exploited by an attacker to write and delete files with th...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2018-11133

The 'fmt' parameter of the '/common/runcrossreport.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting...

Authorization

The 'systemui/settingsnetwork.php' and 'systemui/settingspatching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'XForwardedFor' HTTP headers in a POST request. An anonymous user c...

Design/Logic Flaw

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...