CVE-2018-1731

CVE-2018-1731 affects IBM DOORS Next Generation (DNG/RRC) 5.0–5.0.3 and 6.0–6.0.6. The issue is a cross-site scripting flaw in the Web UI that can cause arbitrary JavaScript execution, potentially leading to credentials disclosure within a trusted session. Affected versions are explicitly listed ...

PT-2019-9453

Name of the Vulnerable Software and Affected Versions IBM DOORS Next Generation DNG/RRC versions 5.0 through 5.0.3 IBM DOORS Next Generation DNG/RRC versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality...

CVE-2018-1913: Improper Neutralization of Input During Web Page Generation

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2019-9733

Name of the Vulnerable Software and Affected Versions IBM DOORS Next Generation DNG/RRC versions 5.0 through 5.0.3 IBM DOORS Next Generation DNG/RRC versions 6.0 through 6.0.6 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality...

CVE-2019-4093

IBM Tivoli Storage Manager IBM Spectrum Protect 8.1.7 could allow a user to restore files and directories using IBM Spectrum Prootect Client Web User Interface on Windows that they should not have access to due to incorrect file permissions. IBM X-Force ID: 157981...

Osmedeus - Fully Automated Offensive Security Tool For Reconnaissance And Vulnerability Scanning

Osmedeus allow you automated run the collection of awesome tools to reconnaissance and vulnerability scanning against the target. How to use If you have no idea what are you doing just type the command below or check out the Advance Usage ./osmedeus.py -t example.com Installation git clone...

CVE-2018-5757

AudioCodes 450HD IP Phone devices running firmware 3.0.0.535.106 are affected by CVE-2018-5757. The traceroute and ping functions on the Monitoring page’s web UI pass a user-controllable parameter from a request to command.cgi into an OS command, enabling remote code execution via shell metachara...

PT-2019-10993

Name of the Vulnerable Software and Affected Versions: AudioCodes 450HD IP Phone version 3.0.0.535.106 Description: An issue was discovered where the traceroute and ping functionality in the Monitoring page of the web UI uses a parameter in a request to command.cgi that unsafely puts user-alterab...

CVE-2018-5757: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...

Input validation

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker...

Input validation

A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has...

CVE-2019-1756

A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has...

CVE-2019-1754

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker...

Improper access control

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...

Security feature bypass

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent WSMA...

CVE-2019-1742

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...

CVE-2019-1753

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent WSMA...

CVE-2019-1742

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...

CVE-2019-1754 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker...

CVE-2019-1754 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker...