Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WAS vulnerability.

Summary Rational Asset Analyzer RAA has addressed the following vulnerability: IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: I...

sagemcom-fast-3890-exploit

Sagemcom Fast 3890 exploit This exploit uses the Cable Haunt...

"Cablehaunt" Cable Modem WebSocket DoS

There exists a buffer overflow vulnerability in certain Cable Modem Spectrum Analyzer interfaces. This overflow is exploitable, but since an exploit would differ between every make, model, and firmware version which also differs from ISP to ISP, this module simply causes a Denial of Service to te...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4225-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4225-1 advisory. It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could use...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4227-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4227-1 advisory. It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux kernel. A physically proximate attack...

CVE-2019-5987

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management Page...

CVE-2019-5990

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer...

CVE-2019-5988

Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Management Page...

CVE-2019-5988

Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Management Page...

CVE-2019-5990

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer...

Design/Logic Flaw

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer...

Command injection

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management Page...

CVE-2019-5990

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer...

CVE-2019-5989

The CVE-2019-5989 issue is a DOM-based cross-site scripting vulnerability in the Analysis Object Page of Access analysis CGI An-Analyzer (released around 2019-06-24). The root cause is DOM-based XSS that could allow a remote attacker to inject arbitrary web script or HTML via the Analysis Object ...

CVE-2019-5988

CVE-2019-5988 affects Access analysis CGI An-Analyzer (ANGLERSNET) and is a stored cross-site scripting vulnerability in the Management Page. The applicable issue is in the Management Page where user-supplied input can be stored and later rendered, enabling an attacker to inject arbitrary web scr...

CVE-2019-5987

This CVE concerns the Access analysis CGI An-Analyzer product. The issue is OS command injection in the Management Page (CVE-2019-5987) that can be triggered by a remote attacker with authentication to the product, allowing execution of arbitrary OS commands. Affected component: the Management Pa...

CVE-2019-5987

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management Page...

CVE-2019-5988: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Management Page...

CVE-2019-5987: Improper Neutralization of Special Elements used in an OS Command

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management Page...

CVE-2019-5989: Improper Neutralization of Input During Web Page Generation

DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page...