CVE-2017-16748

An attacker can log into the local Niagara platform Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system...

CVE-2018-1000635

The Open Microscopy Environment OMERO.server (versions 5.4.0–5.4.6) contains an information exposure vulnerability in which data sent by the server can disclose sensitive information, enabling an attacker to gain full administrative access and potentially disable the server. The issue is stated t...

Citrix XenServer Directory Traversal Vulnerability

Citrix XenServer is an open source virtualization platform for managing cloud, server and desktop virtual infrastructures from Citrix Systems. The platform provides virtual machine monitoring, management and maintenance through an intuitive interface. A directory traversal vulnerability exists in...

AVTech AVC 787 DVR Default Credentials (HTTP)

The remote AVTech AVC 787 DVR device is using known default credentials. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

Unrestricted file upload

A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by...

CVE-2018-14911

A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by...

Imperva SecureSphere 11.5 / 12.0 / 13.0 - Privilege Escalation Exploit

Exploit for linux platform in category local exploits Title: Imperva SecureSphere = v13 - Privilege Escalation Author: 0x09AL Tested on: Imperva SecureSphere 11.5,12.0,13.0 Vendor: https://www.imperva.com/ Vulnerability Description There is a program named PCE.py which runs as root and starts a...

CVE-2018-10592

Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could...

Pydio Remote Code Execution Vulnerability

Pydio formerly known as AjaXplorer is a web-based remote file manager. The manager supports uploading and downloading files, online file editing, image previewing and more. Pydio 8.2.1 and earlier versions have a security vulnerability in the 'scanNow$nodeObject' parameter of the...

CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

Remote code execution

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...

Multiple vulnerabilities in Aterm HC100RC

Overview Aterm HC100RC provided by NEC Corporation contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2018-0634, CVE-2018-0635, CVE-2018-0636, CVE-2018-0637, CVE-2018-0638, CVE-2018-0639 Buffer Overflow CWE-119 - CVE-2018-0640, CVE-2018-0641 Taizoh Tsukamoto of Mits...

Jirafeau Cross-Site Scripting Vulnerability (CNVD-2018-12870)

Jirafeau is a file sharing website system. A cross-site scripting vulnerability exists in the 'search file by link' form in Jirafeau versions prior to 3.4.1. A remote attacker can use this vulnerability to steal sessions and gain administrative privileges...

Jirafeau Cross-Site Scripting Vulnerability

Jirafeau is a file sharing website system. A cross-site scripting vulnerability exists in the 'search file by hash' form in Jirafeau versions prior to 3.4.1. A remote attacker can exploit this vulnerability to steal sessions and gain administrative privileges...

CVE-2018-7778

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

PT-2018-18954 · Paessler · Prtg Network Monitor

Name of the Vulnerable Software and Affected Versions: PRTG Network Monitor versions prior to 18.2.39 Description: An issue was discovered that allows an attacker with access to the PRTG System Administrator web console and administrative privileges to exploit an OS command injection vulnerabilit...

Micro Focus Secure Messaging Gateway Web administration and quarantine component SQL injection vulnerability

Micro Focus Secure Messaging Gateway SMG is a suite of outbound and inbound protection software for enterprise networks and messaging systems from Micro Focus, UK. The product includes features such as virus protection, anti-spam, anti-DDos attacks, and image analysis.Web administration is one of...

The vulnerability of the components ExportSettings.sh, updateWPS, RebootSystem, and vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router’s microprogramming system allows a hacker to gain access to the device with administrator privileges.

The vulnerabilities of the components ExportSettings.sh /cgi-bin/ExportSettings.sh, updateWPS /goform/updateWPS, RebootSystem /goform/RebootSystem, and vpnBasicSettings /goform/vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router software are related to the use of pre-installed registration...