98 matches found
CVE-2020-4074
CVE-2020-4074 affects PrestaShop 1.5.0.0 up to 1.7.6.5 (fixed in 1.7.6.6). The authentication system is malformed, enabling an attacker to forge requests and execute admin commands. Affected component is the authentication/admin command path; root cause described as improper/authentication handli...
Unspecified Vulnerability in Fortinet FortiOS (CNVD-2019-42441)
Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists i...
CVE-2019-6620
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed iControl REST worker vulnerable to command injection for an Administrator user...
Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 2.5 security and bug fix update
An update for ceph and grafana is now available for Red Hat Ceph Storage 2.5 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2018-0625
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter...
CVE-2018-17933
CVE-2018-17933 affects Vecna VGo Robot versions 3.0.3.52164 and 3.0.3.53662 (and earlier). The root issue is improper authorization, allowing user accounts to execute commands outside their privileges, potentially within admin scope, when connected via VGo XAMPP. The IV (under Update A) notes an ...
CVE-2018-17933: Improper Authorization
VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client...
admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files
An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...
admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files
An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...
admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files
An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...
CVE-2017-13664
Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbitrary commands with administrative privileges by retrieving credentials from this file...
Juniper SSG Series device ScreenOS cross-site scripting vulnerability (CNVD-2017-23955)
The Juniper SSG Series is a family of firewall appliances from Juniper Networks.ScreenOS is one of the operating systems. A cross-site scripting vulnerability exists in Firewall+VPN in ScreenOS on Juniper SSG Series devices. A remote attacker can exploit this vulnerability to inject HTML/JavaScri...
CVE-2017-11193
Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these comman...
admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files
An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...
IBM Tivoli NetView Access Services Privilege Gain Vulnerability
IBM Tivoli NetView Access Services NVAS is a suite of session management tools from IBM USA that supports simultaneous access to multiple applications from a single endpoint. A security vulnerability exists in IBM Tivoli NVAS. A remote attacker can exploit the vulnerability to gain privileges by...
ceph-deploy admin command copies keyring file to /etc/ceph which is world readable
It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file...
CVE-2015-4053
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...
PYSEC-2015-3
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...
Command injection
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...
CVE-2015-4053
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...