CVE-2018-12307

ASUSTOR ADM version 3.1.1 is affected by an OS command injection in the user.cgi component. The vulnerability allows an attacker to execute system commands as root via the name POST parameter, enabling full compromise of the device. Descriptions across multiple feeds (NVD/NVD family and CNVD) con...

CVE-2018-12315

ASUSTOR ADM 3.1.1 contains a password verification bypass vulnerability: missing verification allows attackers to change account passwords without the current password. Affected component: ADM password handling. Root cause: inadequate password validation. Impact: unauthorized password changes (no...

CVE-2018-12306

Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344...

CVE-2018-12316

ASUSTOR ADM is affected by OS Command Injection in upload.cgi in version 3.1.1, where an attacker can modify the filename POST parameter to execute system commands. This is documented across multiple sources (NVD CVE-2018-12316, CNVD-2018-25181, OpenVAS entry) with a CVSS base score high (3.0: 8....

CVE-2018-12309

Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...

CVE-2018-12307

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter...

CVE-2018-12314

ASUSTOR ADM 3.1.1 is affected by a directory traversal vulnerability in downloadwallpaper.cgi. The issue allows an attacker to download arbitrary files by manipulating the file and folder URL parameters. This is documented in CVE-2018-12314 (NVD entry) and corroborated by CNVD-2018-25182, which d...

CVE-2018-12306

CVE-2018-12306 describes a directory traversal vulnerability in ASUSTOR ADM’s File Explorer (v3.1.1). An attacker can view arbitrary files by altering the URL parameter file1, indicating improper input handling in the file-path logic. The vulnerability is presented as analogous to CVE-2018-11344....

CVE-2018-12315

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password...

CVE-2018-12311

Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename...

CVE-2018-12319

Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title...

CVE-2018-12314

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

SQL Injection Vulnerability in HuCart adm***.php Page

HuCart HuCart is an open source enterprise building system. HuCart 5.7.4 version adm.php page SQL injection vulnerability , remote attackers can exploit the vulnerability to obtain database sensitive information...

CVE-2018-2478

An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the adm user. The commands executed depen...

ASUSTOR ADM 3.1 scope SQL Injection

SQL Injection vulnerability in ASUSTOR ADM scope parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ADM fails to upgrade ADC in HA -- DEVICE_NOT_REACHABLE

ADM logs:- Error Config8 https://x.x.x.x/nitro/v1/config/nshostname?format=json, Reason: Exception: DEVICENOTREACHABLE Debug Config8 NetScaler x.x..x.xStill rebooting.. Error Config8 DeviceRebootStatus: Reboot Failed for NS x.x.x.x This is how it would appea on ADM When you login to ADC we can...

Citrix ADM does not detect VPX's of SDX after SDX is upgraded from 11.0 to 11.1 and higher versions

We see all the VPX instances on ADM before the upgrade. After SDX is upgraded from 11.0 to 11.1 or a higher version, all the VPX's of the SDX disappear from Citrix ADM. All the config related to those VPX's are lost too. This includes licensed vServers and User Group entities bound to that VPX on...

CVE-2018-16752

LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases...

CVE-2018-16752

CVE-2018-16752 affects LINK-NET LW-N605R devices running firmware 12.20.2.1486. The vulnerability enables Remote Code Execution via shell metacharacters in the HOST field of the ping feature (adm/systools.asp). Authentication is required, and in some cases the default admin password may be usable...

LW-N605R Remote Code Execution

''' Title: LW-N605R - Remote Code Execution Author: Nassim Asrir Contact: [email protected] | https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vendor: LINK-NET Description: LW-N605R devices allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at...