PT-2018-11131

Name of the Vulnerable Software and Affected Versions ECOS System Management Appliance aka SMA version 5.2.68 Description The issue concerns incorrect access control, allowing a user to compromise authentication keys and manipulate security configurations through unrestricted database access duri...

PT-2018-11134

Name of the Vulnerable Software and Affected Versions ECOS System Management Appliance aka SMA version 5.2.68 Description The issue concerns an undocumented factory backdoor that allows the vendor to extract confidential information and manipulate security-relevant configurations. This is achieve...

CVE-2018-12338: Undefined Security Weakness

Undocumented Factory Backdoor in ECOS System Management Appliance aka SMA 5.2.68 allows the vendor to extract confidential information and manipulate security relevant configurations via remote root SSH access...

CVE-2018-12335: Incorrect Permission Assignment for Critical Resource

Incorrect access control in ECOS System Management Appliance aka SMA 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment...

Cross site scripting

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 is vulnerable to Cross‑Site Scripting via the site name parameter on adm1n/admin_config.php (system management page). The root cause is an XSS flaw in the site name input; impact is user‑visible script injection. The connected records confirm the vulnerability across multiple sources...

Ecos Secure Boot Stick 5.6.5 Credential Disclosure / Information Leak

MULTIPLE SECURITY ISSUES IN ECOS SECURE BOOT STICK SBS - Software: Ecos Secure Boot Stick - Version: Stick Version 5.6.5, System Management Version 5.2.68 - Vendor Status: Vendor informed - Release Date: 13/06/2018 The latest version of this document may be downloaded from...

[SECURITY] Fedora 27 Update: ruby-2.4.4-89.fc27

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

Quest KACE System Management Appliance Command Injection Vulnerability (CNVD-2018-10906)

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A command injection vulnerability exists in Quest KACE System Management Appliance version 8.0.318. An attacker can use this vulnerability to inject arbitrary commands and execute them with root...

Input validation

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...

Quest KACE System Management Virtual Appliance Path Traversal Vulnerability

Quest KACE System Management Virtual Appliance is an IT asset management appliance from Quest Software, USA. A path traversal vulnerability exists in Quest KACE System Management Virtual Appliance version 8.0.318. The vulnerability can be exploited by an attacker to write and delete files with th...

CVE-2018-11140

The 'reportID' parameter received by the '/common/runreport.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, an error-based type...

CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...

Design/Logic Flaw

The script '/adminui/errordetails.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks...

Command injection

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue...

Sql injection

The 'reportID' parameter received by the '/common/runreport.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, an error-based type...

CVE-2018-11132

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue...