SoftNAS Cloud Command Execution Vulnerability

SoftNAS Cloud is a software-defined NAS file management system from US-based SoftNAS. The system is primarily used to provide enterprise-class NAS functionality, including encryption, snapshots and automatic failover. A security vulnerability exists in SoftNAS Cloud versions 4.2.0 and 4.2.1. A...

CVE-2018-0626

Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter...

The vulnerability of Cisco Small Business network devices’ microprogramming software relates to the use of pre-installed credentials. This allows attackers to bypass authentication procedures and execute arbitrary commands with administrator privileges.

The vulnerability of Cisco Small Business network device software’s microprogramming lies in the use of pre-installed credentials. This vulnerability could allow a malicious actor to bypass authentication procedures and execute arbitrary commands with administrator privileges...

CVE-2018-17933

VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client...

OpenVPN Cross-Site Scripting Vulnerability

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

CVE-2017-2336

A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker...

Cross site scripting

A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker...

CVE-2015-7274

CVE-2015-7274 affects Dell iDRAC6 prior to version 2.80. The vulnerability allows remote attackers to execute arbitrary administrative HTTP commands. No exploits or mitigation details are provided in the connected documents; remediation status not stated.

WBCE CMS vulnerable to SQL injection

Overview WBCE CMS provided by WBCE Team is an open-source Contents Management System CMS. WBCE CMS contains an SQL injection vulnerability CWE-89. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

Shopify: Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181

What is Zookeeper? ==================== Zookeeper is a coordination service for distributed applications. It allows common services such as naming, synchronisation, configuration management and group services to be managed by a simple interface and It uses a data model of File System on an...

Cisco Wireless Residential Unauthorized Command Vulnerability

A vulnerability with web interface access authentication of the Cisco EPC3928 Wireless Residential Gateway could allow an unauthenticated, remote attacker to issue a subset of commands as the administrator without authenticating to the device. The vulnerability is due to lack of authentication...

CVE-2015-7984

Multiple cross-site request forgery CSRF vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary 1 commands via the cmd paramet...

teamspeak <= 3.0.0-beta25 Multiple Vulnerabilities

No description provided by source. Luigi Auriemma Application: TeamSpeak 3 http://www.teamspeak.com Versions: = 3.0.0-beta23 2.x not affected Platforms: Windows, Mac OS X and Linux Bugs: A execution of various admin commands B various failed assertions C various NULL pointer dereferences...

TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities

Luigi Auriemma Application: TeamSpeak 3 http://www.teamspeak.com Versions: = 3.0.0-beta23 2.x not affected Platforms: Windows, Mac OS X and Linux Bugs: A execution of various admin commands B various failed assertions C various NULL pointer dereferences Exploitation: remote, versus server Date: 1...

TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities

TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities Luigi Auriemma Application: TeamSpeak 3 http://www.teamspeak.com Versions: = 3.0.0-beta23 2.x not affected Platforms: Windows, Mac OS X and Linux Bugs: A execution of various admin commands B various failed assertions C various NULL pointer...

CVE-2002-0770

Quake 2 Q2 server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated...