Western Digital MyCloud PR4100 Web Management Component 'multi_uploadify' File Upload Vulnerability

The Western Digital MyCloud PR4100 is a networked cloud storage device from Western Digital.The web administration component is one of the web administration components. A security vulnerability exists in the Web administration component of the Western Digital MyCloud PR4100 version 2.30.172. An...

Palo Alto Networks Firewalls Remote Root Code Execution Vulnerability

Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on PAN-OS versions 6.1.18 and earlier, PAN-OS versions 7.0.18 and earlier, PAN-OS versions 7.1.13 and earlier, and PAN-OS versions 8.0.5 and earlier. Full...

Palo Alto Networks firewalls remote root code execution(CVE-2017-15944)

This is a public advisory for CVE-2017-15944 which is a remote root code execution bug in Palo Alto Networks firewalls. Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on: PAN-OS 6.1.18 and earlier, PAN-OS...

Cisco Jabber for Windows, Mac, Android and iOS Cisco Jabber Cross-Site Scripting Vulnerability (CNVD-2017-36129)

Cisco Jabber for Windows, Mac, Android and iOS is a set of unified communications client solutions for Windows, Mac, Android and iOS platforms from Cisco USA. The solution provides online status display, instant messaging, voice and other features. A cross-site scripting vulnerability exists in t...

Weak Password Vulnerability in WEB Management Interface of Pelco Sarix Pro Network Camera

pelco Sarix Professional is a video camera. A weak password vulnerability exists in the WEB management interface of the pelco Sarix Pro network camera. An attacker can obtain a hidden administrative account and use this account to perform any background operation, gain administrative privileges,...

Pelco Sarix Pro Network Camera WEB Management Interface Login Bypass Vulnerability

pelco Sarix Professional is a video camera. A login bypass vulnerability exists in the WEB management interface of the pelco Sarix Pro network camera. This allows an attacker to bypass password authentication and log in to the WEB management interface directly as an administrator...

Foscam IP Video Camera CGIProxy.fcgi SoftAP Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SoftAP configuration...

The vulnerability of the HTTP Web-management component of Edgewater Networks Edgemarc software allows a perpetrator to execute arbitrary commands.

The vulnerability of the HTTP Web-management component of Edgewater Networks Edgemarc software is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands, using a hidden page as an interface for executing these...

中兴集成多业务路由器-ZXR10 1800-2S 敏感信息泄露漏洞

介绍 ZXR10 1800-2S 路由器是中兴通讯推出的集路由、交换、无线、安全、 VPN 于一体的智能集成多业务路由器产品，凭借模块化、可扩展的系统架构，为用户构建智能、高效、可靠、灵活、易维的网络。 该路由器可广泛灵活的适用于大客户接入、 DCN、园区网、校园网、政企网的出口网关、企业的总部/分支接入、金融网点、移动办公室、行业网纵向网的汇聚/接入等网络。 CVE/CNVD/CNNVD & 厂商回应 CVE-2017-10930...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Command Injection Vulnerability(CVE-2017-2845)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tes...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Sender Parameter Configuration Command Injection Vulnerability(CVE-2017-2844)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...

Foscam IP Video Camera CGIProxy.fcgi Account Creation Command Injection Vulnerability(CVE-2017-2827)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting...

Foscam IP Video Camera CGIProxy.fcgi Account Password Command Injection Vulnerability(CVE-2017-2828)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resultin...

Foscam IP Video Camera WebService CGI Parameter Code Execution Vulnerability(CVE-2017-2805)

Summary An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simp...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Host Parameter Configuration Command Injection Vulnerability(CVE-2017-2841)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...

Symantec Messaging Gateway <= 10.6.3-2 unauthenticated root RCE(CVE-2017-6327)

Bug 1: Web authentication bypass The web management interface is available via HTTPS, and you can't do much without logging in. If the current session identified by the JSESSIONID cookie has the user attribute set, the session is considered authenticated. The file LoginAction.class defines a numb...

Cisco Adaptive Security Appliance Cross-Site Scripting Vulnerability (CNVD-2017-20381)

Cisco Adaptive Security Appliance ASA, Adaptive Security Appliance is a set of firewall appliances from the American company Cisco Cisco. The appliance also includes IPS Intrusion Prevention System, SSL VPN, IPSec VPN, anti-spam, and more. A cross-site scripting vulnerability exists in the...

Cisco Adaptive Security Appliance Cross-Site Scripting Vulnerability (CNVD-2017-20380)

The Cisco Adaptive Security Appliance is a set of firewall appliances from the American company Cisco. A cross-site scripting vulnerability exists in the Cisco Adaptive Security Appliance WEB management script, which allows remote attackers to exploit the vulnerability to inject malicious script ...

CVE-2017-6749

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Affected Products: virtual and...

File Upload Vulnerability in ShyPost Enterprise Web Management System v16.0

ShyPost Enterprise Management System is a set of ASP-based intelligent website building software. ShyPost Enterprise Website Management System v16.0 has a file upload vulnerability that can be exploited by an attacker to gain control of the server...