CVE-2017-16786

The CVE-2017-16786 issue affects Meinberg LANTIME Web Configuration Utility on devices with firmware prior to 6.24.004. The vulnerability allows remote, authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2, or (2) vect...

Meinberg LANTIME Web Configuration Utility Directory Traversal Vulnerability

Meinberg LANTIME is an NTP time server from Meinberg, Germany.Web Configuration Utility is one of the web configuration utilities. A directory traversal vulnerability exists in the Upload Groupkey function of the Web Configuration Utility in Meinberg LANTIME with firmware version 6.24.004. A remo...

Meinberg LANTIME Web Arbitrary File Read Vulnerability

Meinberg LANTIME is an NTP time server from Meinberg, Germany.Web Configuration Utility is one of the web configuration utilities. A security vulnerability exists in the Web Configuration Utility in Meinberg LANTIME with firmware prior to version 6.24.004. A remote attacker can exploit the...

Design/Logic Flaw

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...

CVE-2017-16787

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...

CVE-2017-16787

The CVE-2017-16787 issue affects Meinberg LANTIME Web Configuration Utility on LTOS6 devices with firmware earlier than 6.24.004. The root cause is a failure to restrict URL access, allowing remote attackers to read arbitrary files by accessing the web config CGI (e.g., mainv2) and using paramete...

CVE-2017-16788

CVE-2017-16788 affects Meinberg LANTIME Web Configuration Utility on LTOS6 devices with firmware before 6.24.004. The vulnerability is a directory traversal in the Upload Groupkey functionality that allows remote-authenticated Admin-User actors to write to arbitrary files and potentially gain roo...

Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass Vulnerability

Exploit for cgi platform in category web applications Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects:...

Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read Vulnerability (2)

Exploit for cgi platform in category web applications Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload Path Traversal Author: Jakub Palaczynski CVE: CVE-2017-16788 Exploit was tested on: ====================== Meinberg LANTIME Web Configuration Utility 6.16.008...

Meinberg LANTIME Web Configuration Utility 6.16.008 Authentication Bypass

Title: Meinberg LANTIME Web Configuration Utility - Failure to Restrict URL Access Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases befo...

Meinberg LANTIME Web Configuration Utility 6.16.008 Arbitrary File Read

Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases before 6.24.004...

Meinberg LANTIME Web Configuration Utility 6.16.008 Arbitrary File Upload

Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload Path Traversal Author: Jakub Palaczynski CVE: CVE-2017-16788 Exploit was tested on: ====================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware...

Synology Photo Station Information Disclosure Vulnerability (CNVD-2018-00112)

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. An information disclosure vulnerability exists in the default HTTP configuration file in Synology Photo Station versions prior to 6.8.1-3458 and prior to 6.3-2970. A remote attacker can exploit...

Twenty-two brand router vulnerability Distribution Report-vulnerability warning-the black bar safety net

Now, with cybercrime techniques to constantly renovate our home router has also recently become a cyber-attack new target. In fact, home routers indeed there are a lot of security vulnerabilities. Álvaro Folgado Rueda and many other network security experts recently wrote a report, in-depth...

MS15-041: Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: April 14, 2015

MS15-041: Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: April 14, 2015 View products that this article applies to. Summary This update resolves a vulnerability in the Microsoft .NET Framework that could allow...

InfraPower PPS-02-S Q213V1 - Local File Disclosure

InfraPower PPS-02-S Q213V1 - Local File Disclosure InfraPower PPS-02-S Q213V1 Local File Disclosure Vulnerability Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware: IPD-02-FW-v03 Summary:...

FreePBX 13.0.35 remote code execution

A vulnerability overview 1. Vulnerability description FreePBX is called the Asterisk Management Portal, IP telephony tools Asterisk standardized implementation that provides a Web configuration interface and other workers FreePBX in functions.inc.php file exists for the parameters without...

WSO2 Carbon 4.4.5 Local File Inclusion

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-LOCAL-FILE-INCLUSION.txt + ISR: ApparitionSec Vendor: =============== www.wso2.com Product: ==================== Ws02Carbon v4.4.5 WSO2 Carbon is the core...

SedSystems D3 Decimator - Multiple Vulnerabilities

SedSystems D3 Decimator Multiple Vulnerabilities ================================================ Identification of the vulnerable device can be performed by scanning for TCP port 9784 which offers a default remote API. When connected to this device it will announce itself with "connected" or...

PT-2015-6092 · Unknown · Thermostat

Name of the Vulnerable Software and Affected Versions: Thermostat versions prior to 2.0.0 Description: The issue allows local users to obtain user credentials by reading the web.xml configuration file due to world-readable permissions. Recommendations: For versions prior to 2.0.0, update to versi...