The vulnerability of the embedded web-server microprogramming software module of the APC MGE SNMP/Web Card Transverse 66074 allows a intruder to obtain administrator account data.

The vulnerability of the embedded web-server-based microprogramming software module for the APC MGE SNMP/Web Card Transverse 66074 relates to the transmission of credentials in an unencrypted form. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain...

Hackers Found Using A New Code Injection Technique to Evade Detection

While performing in-depth analysis of various malware samples, security researchers at Cyberbit found a new code injection technique, dubbed Early Bird, being used by at least three different sophisticated malware that helped attackers evade detection. As its name suggests, Early Bird is a "simpl...

Mail.ru: [lk-cdn.3igames.mail.ru] apc.php

APC UPS status monitoring script was available from outside on lk-cdn.3igames.mail.ru 3igames.mail.ru is not currently covered with bug bounty program...

codeigniter -- input validation bypass

The CodeIgniter changelog reports: Security: Fixed a potential object injection in Cache Library 'apc' driver when save is used with $raw = TRUE...

licensing.apc.com XSS vulnerability

Vulnerable URL: http://licensing.apc.com/licpart/partner.Php?lg=EN=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 22.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VI...

CVE-2017-7884

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM...

CVE-2017-7884

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM...

Default configuration

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM...

CVE-2017-7884

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM...

CVE-2017-7884

In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM...

APC UPS Daemon 3.14.14 Privilege Escalation

Credits: fragsh3ll aka Richard Young + Contact: https://twitter.com/fragsh3ll Vendor ========== http://www.apcupsd.org Product =========== APC UPS Daemon = 3.14.14 Vulnerability Type ===================== Privilege Escalation Vendor Description ===================== Apcupsd can be used for power...

W3 Total Cache <= 0.9.4.1 – Unauthenticated Security Token Bypass

The /pub/apc.php file is used to empty the OPCache/APC. The script seems protected by a nonce aka security token: $nonce = W3Request::getstring'nonce'; $uri = $SERVER'REQUESTURI'; if wphash$uri == $nonce But the flaw stays in the == operator which is not the one to use when you want to compare...

W3 Total Cache <= 0.9.4.1 – Unauthenticated Security Token Bypass

The /pub/apc.php file is used to empty the OPCache/APC. The script seems protected by a nonce aka security token: $nonce = W3Request::getstring'nonce'; $uri = $SERVER'REQUESTURI'; if wphash$uri == $nonce But the flaw stays in the == operator which is not the one to use when you want to compare...

Fedora 24 : phpMyAdmin (2016-e3240782ec)

phpMyAdmin 4.6.2 2016-05-25 ============================= - security User SQL queries can be revealed through URL GET parameters, see PMASA-2016-14 - security Self XSS vulneratbility, see PMASA-2016-16 - Use https for documentation links - Fix schema export with too many tables - Avoid parsing no...

PT-2018-37: Unauthorized Actions in APC Uninterrupted Power Supplies

The specialists of the Positive Research center have detected an Unauthorized Actions vulnerability in APC Uninterrupted Power Supplies. Vulnerability in Schneider Electric's MGE SNMP/Web Card 66074 installed in MGE UPS and MGE STS, related to the integrated web server Port 80/443/TCP, allows...

PT-2018-35: Authorization Bypass in APC Uninterrupted Power Supplies

The specialists of the Positive Research center have detected an Authorization Bypass vulnerability in APC Uninterrupted Power Supplies. Vulnerability in Schneider Electric's MGE SNMP/Web Card 66074 installed in MGE UPS and MGE STS, related to the integrated web server Port 80/443/TCP, allows...

PT-2018-36: Information Disclosure in APC Uninterrupted Power Supplies

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in APC Uninterrupted Power Supplies. Vulnerability in Schneider Electric's MGE SNMP/Web Card 66074 installed in MGE UPS and MGE STS, related to the integrated web server Port 80/443/TCP, allows...

PT-2018-38: Information Disclosure in APC Uninterrupted Power Supplies

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in APC Uninterrupted Power Supplies. Vulnerability in Schneider Electric's MGE SNMP/Web Card 66074 installed in MGE UPS and MGE STS, related to the integrated web server Port 80/443/TCP and SSL...

Oracle: Security Advisory (ELSA-2012-0811)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 23 Update: php-ZendFramework2-2.4.8-1.fc23

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...