Vyaire Medical CareFusion Upgrade Utility Vulnerability

OVERVIEW Independent researcher Mark Cross @xerubus has identified an uncontrolled search path element vulnerability in Vyaire Medical’s CareFusion Upgrade Utility application. Vyaire Medical has produced an update that mitigates this vulnerability. AFFECTED PRODUCTS The following versions of...

CVE-2018-5457: Uncontrolled Search Path Element

A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior versions. A successful exploit of this vulnerability requires the local user to install a crafted DLL on the target machine. The applicatio...

Updated jbig2dec packages fix security vulnerability

libjbig2dec.a in Artifex jbig2dec 0.13 has a NULL pointer dereference in the jbig2huffmanget function in jbig2huffman.c. For example, the jbig2dec utility will crash segmentation fault when parsing an invalid file CVE-2017-9216...

Meinberg LANTIME Web Configuration Utility Arbitrary File Read Vulnerability

Meinberg LANTIME is an NTP time server from Meinberg, Germany.Web Configuration Utility is one of the web configuration utilities. A security vulnerability exists in the Web Configuration Utility on Meinberg LANTIME with firmware prior to version 6.24.004. A remote attacker can exploit the...

PT-2017-14548 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.4-15217 Synology DiskStation Manager DSM versions prior to 6.0.3-8754-6 Description: An improper access control issue in synodsmnotify allows local users to inject arbitrary web script or...

F5 BIG-IP Advanced Firewall Manager Configuration utility SQL Injection Vulnerability

F5 BIG-IP Advanced Firewall Manager AFM is a firewall manager from F5 USA that scales to stop high-volume DDoS attacks that can overwhelm load balancers, firewalls, and even networks.The Configuration utility... An SQL injection vulnerability exists in Configuration utility in F5 BIG-IP AFM. A...

CVE-2017-0304

A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live...

PT-2017-10509

Name of the Vulnerable Software and Affected Versions BIG-IP AFM versions 12.0.0 through 13.0.0 Description A SQL injection issue exists in the BIG-IP AFM management UI. This may allow tampering with a copy of the firewall rules, impacting the Configuration Utility until a resync of the rules...

CVE-2017-0304: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live...

CVE-2017-16786

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via 1 the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or 2 vectors involving curl support of the "file" schema in the...

CVE-2017-16786: Exposure of Sensitive Information to an Unauthorized Actor

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via 1 the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or 2 vectors involving curl support of the "file" schema in the...

Meinberg LANTIME Web Arbitrary File Read Vulnerability

Meinberg LANTIME is an NTP time server from Meinberg, Germany.Web Configuration Utility is one of the web configuration utilities. A security vulnerability exists in the Web Configuration Utility in Meinberg LANTIME with firmware prior to version 6.24.004. A remote attacker can exploit the...

CVE-2017-16787

The CVE-2017-16787 issue affects Meinberg LANTIME Web Configuration Utility on LTOS6 devices with firmware earlier than 6.24.004. The root cause is a failure to restrict URL access, allowing remote attackers to read arbitrary files by accessing the web config CGI (e.g., mainv2) and using paramete...

CVE-2017-16788

CVE-2017-16788 affects Meinberg LANTIME Web Configuration Utility on LTOS6 devices with firmware before 6.24.004. The vulnerability is a directory traversal in the Upload Groupkey functionality that allows remote-authenticated Admin-User actors to write to arbitrary files and potentially gain roo...

CVE-2017-16788: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with Admin-User access to write to arbitrary files and consequently gain root privileges by uploadi...

CVE-2017-16787: Exposure of Sensitive Information to an Unauthorized Actor

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...

PT-2017-14561

Name of the Vulnerable Software and Affected Versions Meinberg LANTIME devices with firmware prior to 6.24.004 Description The issue concerns a directory traversal vulnerability in the "Upload Groupkey" functionality of the Web Configuration Utility. This vulnerability allows remote authenticated...

PT-2017-14560

Name of the Vulnerable Software and Affected Versions Meinberg LANTIME devices with firmware prior to 6.24.004 Description The issue allows remote attackers to read arbitrary files due to a failure in restricting URL access in the Web Configuration Utility. Recommendations For firmware versions...

Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass

Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases befo...

Meinberg LANTIME Web Configuration Utility 6.16.008 Arbitrary File Upload

Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload Path Traversal Author: Jakub Palaczynski CVE: CVE-2017-16788 Exploit was tested on: ====================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware...