CVE-2014-9619

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file...

Unrestricted file upload

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file...

CVE-2015-3657

Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privileges via unspecified vectors...

CVE-2015-3657

The CVE-2015-3657 entry concerns Aruba Networks ClearPass Policy Manager. Affected versions are CPPM before 6.4.7 and 6.5.x before 6.5.2. A remote attacker who is an authenticated lower‑level administrator can escalate to Super Admin privileges via unspecified vectors. The vulnerability is descri...

Red-Gate SQL Monitor 3.10 4.2 - Authentication Bypass

Red-Gate SQL Monitor 3.10 4.2 - Authentication Bypass Exploit Title: Red-Gate SQL Monitor authentication bypass Version: Redgate SQL Monitor before 3.10 and 4.x before 4.2 Date: 2017-08-10 Red-Gate made a security announcement and publicly released the fixed version more than two years before thi...

Synology Photo Station Deserialization Vulnerability

Synology Photo Station is an online photo album and blog owned and managed by DSM users. A deserialization vulnerability in synophotocsPhotoMisc.php in Synology Photo Station can be exploited by remote attackers to gain administrator privileges via a specially crafted serialized payload...

Dashlane - DLL Hijacking

Vulnerability Summary The following advisory describes a DLL Hijacking vulnerability found in Dashlane. Dashlane is “a password manager app and secure digital wallet. The app is available on Mac, PC, iOS and Android. The app’s premium feature enables users to securely sync their data between an...

File Upload Vulnerability in Longcai MX of Longcai Technology Inc.

Longcai MX is a marketing website that caters to consumer needs and buying desires. A file upload vulnerability exists in Longcai MX, a subsidiary of Longcai Technology, due to the system's failure to strictly filter file contents. An attacker can upload arbitrary files and obtain administrator...

CVE-2017-3222

Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager...

Juniper SSG Series device ScreenOS cross-site scripting vulnerability (CNVD-2017-23957)

The Juniper SSG Series is a family of firewall appliances from Juniper Networks.ScreenOS is one of the operating systems. A cross-site scripting vulnerability exists in Firewall+VPN in ScreenOS on Juniper SSG Series devices. A remote attacker can exploit this vulnerability to inject HTML/JavaScri...

CVE-2017-8004

The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance RSA IMG versio...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

No Free Pass for ExPetr

Recently, there have been discussions around the topic that if our product is installed, ExPetr malware won't write the special malicious code which encrypts the MFT to MBR. Some have even speculated that some kind of conspiracy might be ongoing. Others have pointed out it's plain and simple...

Dasan Networks GPON ONT WiFi Router H64X Series - Privilege Escalation

Dasan Networks GPON ONT WiFi Router H64X Series - Privilege Escalation Dasan Networks GPON ONT WiFi Router H64X Series Privilege Escalation Vendor: Dasan Networks Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu Affected version: Model: H640GR-02 H640GV-03 H640GW-02...

WMI Event Subscription Persistence

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'msf/core/post/windows/powershell' require 'msf/core/post/file' class MetasploitModule 'WMI Event Subscription Persistence',...

EMC ESRS Policy Manager Default Password Vulnerability

EMC ESRS Policy Manager is a suite of remote service policy management software from EMC Corporation that provides a two-way remote connection between EMC customer service and end-user EMC products and solutions. A security vulnerability exists in versions of EMC ESRS Policy Manager prior to 6.8....

CVE-2017-4976

EMC ESRS Policy Manager before version 6.8 contains an undocumented OpenDS admin account with a default password. A remote attacker who knows the default password can log in and gain administrator privileges on the local LDAP server. A remediation is available in EMC Security Remote Services Poli...

CVE-2017-2234

Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier, Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier may allow remote attackers to access a non-documented developer screen to perform operations on device with administrative privileges...

Arbitrary File Upload, Cross-site Request Forgery Vulnerability in zzcms

zzcms is an enterprise website builder. zzcms 8.1 version exists arbitrary file upload, cross-site request forgery vulnerability, an attacker can exploit this vulnerability by masquerading as a request from a trusted user to perform an unauthorized operation, upload arbitrary files and obtain...

Pilot Future (Beijing) Technology Co., Ltd. digital campus learning platform has an administrator arbitrary password login vulnerability

Microknowledge Base is to provide a platform for the operation and management of self-resource libraries. An administrator arbitrary password login vulnerability exists in the Digital Campus Learning Platform. The vulnerability stems from a hard-coded or permission judgment business logic...