WebEx Local Service Permissions Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebEx Local Service Permissions Exploit', 'Description' = %q This module exploits a flaw in the 'webexservice' Windows service, which runs as...

IPFire Firewall Command Injection Vulnerability

IPFire Firewall is an open source Linux-based firewall system . A command injection vulnerability exists in the backup.cgi file in versions prior to IPFire Firewall 2.21 Core Update 124, which can be exploited by an attacker to execute arbitrary commands...

Teltonika RUT9XX Arbitrary Command Execution Vulnerability

Teltonika RUT9XX routers also known as LuCI is a router product from the Lithuanian company Teltonika. An arbitrary command execution vulnerability exists in Teltonika RUT9XX with firmware version lower than 00.04.233, which is caused by the program's failure to perform proper access control and...

Multiple vulnerabilities in FileZen

Overview FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains multiple vulnerabilities listed below. Directory traversal CWE-22 - CVE-2018-0693 OS command injection CWE-78 - CVE-2018-0694 Soliton Systems K.K...

CVE-2018-12441

The CorsairService in Corsair Utility Engine has insecure default permissions: the Everyone group is granted SERVICE_ALL_ACCESS, enabling unprivileged local users to modify CorsairService BINARY_PATH_NAME and execute arbitrary commands, resulting in complete control of the system. Connected docum...

[ASA-201810-8] patch: multiple issues

Arch Linux Security Advisory ASA-201810-8 ========================================= Severity: High Date : 2018-10-09 CVE-ID : CVE-2018-6951 CVE-2018-6952 CVE-2018-1000156 Package : patch Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-619 Summary ======= The package...

Cisco Identity Services Engine WEB Management Interface Arbitrary Command Execution Vulnerability

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A security vulnerability...

Cisco Video Surveillance Manager Device Default Password Vulnerability

Cisco Video Surveillance Operations Manager is an enterprise-class video configuration and management solution. A device default password vulnerability exists in Cisco Video Surveillance Manager due to the presence of undocumented default static user credentials for the root account of the affect...

The vulnerability of ProtonVPN’s software for accessing VPN services arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a malicious user to execute arbitrary commands or code with SYSTEM privileges.

The vulnerability of ProtonVPN’s software for accessing VPN services arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or code with SYSTEM privilege...

CVE-2018-17228

nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call...

Design/Logic Flaw

nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call...

PT-2018-2283 · Cisco · Cisco Small Business Routers

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could...

Default credentials

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

CVE-2017-3912

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

CVE-2017-3912 McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

Information Builders WebFOCUS Business Intelligence Portal Command Injection Vulnerability

Information Builders WebFOCUS Business Intelligence Portal is a Business Intelligence Portal system from Information Builders USA. A command injection vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal version 8.1, which can be exploited by sending a specially...

Debian DLA-1495-1 : git-annex security update

The git-annex package was found to have multiple vulnerabilities when operating on untrusted data that could lead to arbitrary command execution and encrypted data exfiltration. CVE-2017-12976 git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an...

OpenEMR Remote Code Execution Vulnerability

OpenEMR is the open source electronic health record and medical practice management solution. OpenEMR suffers from a remote code execution vulnerability. Due to the failure to strictly filter incoming parameters when modifying configurations in the background, an attacker can exploit the...

Debian: Security Advisory (DLA-1455-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

Concatenating unsanitized user input in the whereis npm module 0.4.1 allowed an attacker to execute arbitrary commands. The whereis module is deprecated and it is recommended to use the which npm module instead...