Stack overflow

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure to resolve a hostname during a ping or traceroute attempt. This allows an authenticated user to execute arbitrary code. The exploit can b...

CVE-2019-13280

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure to resolve a hostname during a ping or traceroute attempt. This allows an authenticated user to execute arbitrary code. The exploit can b...

CVE-2019-13277: Undefined Security Weakness

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizard functionality, giving this attacker the ability to change configuration values, potentially leading to a denial of service. The request can be made on the local intranet or...

The vulnerability in the web interface of the Cisco Integrated Management Controller, a software tool for remote server management, allows a perpetrator to disclose protected information.

The vulnerability of the web interface of the Cisco Integrated Management Controller software for remote administration lies in the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially crafted...

The vulnerability of the Oracle Secure Global Desktop administration console allows for the execution of arbitrary code in the user’s browser or access to confidential information.

The vulnerability of Oracle Secure Global Desktop administration consoles exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser or gain access to confidential information...

The vulnerability in the web interface of the Cisco Integrated Management Controller, a software tool for remote administration of servers, allows a perpetrator to perform arbitrary actions on the vulnerable device.

The vulnerability of the web interface for controlling Cisco Integrated Management Controllers involves the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device using a specially crafted link...

Security Bulletin: Multiple Security Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM License Key Server Administration & Reporting Tool and Agent

Summary Multiple Security Vulnerabilities in IBM WebSphere Application Server Liberty, used by IBM License Key Server Administration & Reporting Tool and Agent, has been published. IBM License Key Server Administration & Reporting Tool and Agent team has come up with a remediation. Vulnerability...

[SECURITY] Fedora 29 Update: glpi-9.3.4-2.fc29

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

[SECURITY] Fedora 30 Update: glpi-9.4.3-1.fc30

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

FaceSentry Access Control System 6.4.8 Cleartext Password Storage

FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorithm A14 Summary: FaceSentry 5AN is a...

FaceSentry Access Control System 6.4.8 - Remote Command Injection

FaceSentry Access Control System 6.4.8 Remote Command Injection Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorithm A14 Summary: FaceSentry 5AN is a revolutionar...

FaceSentry Access Control System 6.4.8 - Remote SSH Root

!/usr/bin/env python -- coding: utf-8 -- FaceSentry Access Control System 6.4.8 Remote SSH Root Access Exploit Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorith...

Security Bulletin: IBM Planning Analytics Administration is affected by a vulnerability

Summary IBM Planning Analytics Administration has addressed a Cross-Site Scripting XSS vulnerability which could allow users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. This has...

Exclusive: German Police Raid OmniRAT Developer and Seize Digital Assets

The German police yesterday raided the house of the developer of OmniRAT and seized his laptop, computer and mobile phones probably as part of an investigation into a recent cyber attack, a source told The Hacker News. OmniRAT made headlines in November 2015 when its developer launched it as a...

Exclusive: German Police Raid OmniRAT Developer and Seize Digital Assets

The German police yesterday raided the house of the developer of OmniRAT and seized his laptop, computer and mobile phones probably as part of an investigation into a recent cyber attack, a source told The Hacker News. OmniRAT made headlines in November 2015 when its developer launched it as a...

Code injection

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...

CVE-2019-0303

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...

CVE-2019-0303

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...

CVE-2019-0303

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...

CVE-2019-0303

CVE-2019-0303 affects SAP BusinessObjects BI Platform Administration Console (versions 4.2 and 4.3) where the BILogon/appService.jsp redirects reflect the requested errMsg parameter into the response without sanitization, enabling potential cross-site scripting when the URL is accessed. Related c...