McAfee True Key (TK) Windows Client Arbitrary Command Execution Vulnerability

McAfee True Key TK is an authentication application from the American company McAfee. The program supports features such as facial information recognition and fingerprint recognition. A security vulnerability exists in the Microsoft Windows client in McAfee TK 5.1.230.7 and earlier versions. A...

CVE-2018-19908: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php the STIX 1 import code, an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filenam...

PT-2018-1995

Name of the Vulnerable Software and Affected Versions McAfee True Key Windows Client versions 5.1.230.7 and earlier Description The issue is related to privilege management errors in the McAfee True Key Windows Client, which can be exploited to execute arbitrary commands. This can allow an attack...

PT-2018-15158

Name of the Vulnerable Software and Affected Versions MISP versions 2.4.9x through 2.4.98 Description An issue was discovered in the STIX 1 import code of MISP, where an unescaped filename string is used to construct a shell command. This can be abused by a malicious authenticated user to execute...

56iq digital signage software frontend has an override access vulnerability

56iq digital signage software is a digital signage content creation software, used to create exciting programs in plasma liquid crystal LCD flat-panel TVs, LED screens, projection equipment and other multimedia terminals playback and touch interactive applications. An override access vulnerabilit...

NUUO NVRMini2 3.9.1 - (Authenticated) Command Injection

Exploit Title: NUUO NVRMini2 Authenticated Command Injection Date: December 3, 2018 Exploit Author: Artem Metla Vendor Homepage: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9.1 Tested on: NUUO NVRMini2 with firmware 3.9.1 CVE : CVE-2018-15716 Advisory:...

Netgate pfSense CE Command Injection Vulnerability

Netgate pfSense CE is the United States Netgate company's set of free open source FreeBSD-based firewall and router software. A command injection vulnerability exists in the 'powerdbatterymode' POST parameter in Netgate pfSense CE version 2.4.4-RELEASE, which can be exploited by an attacker to...

Apache Hadoop elevation of privilege vulnerability (CNVD-2018-24261)

Apache Hadoop is the U.S. Apache Apache Software Foundation's set of open source distributed systems infrastructure, it can be distributed processing of large amounts of data, and has high reliability, high scalability, high fault tolerance and other characteristics. A security vulnerability exis...

CronJob API Privilege Escalation

The vulnerability in the CronJob API of Cisco Digital Network Architecture DNA platform is caused by errors in processing input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands with root privileges remotely...

CVE-2018-18561: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the...

PT-2018-14515

Name of the Vulnerable Software and Affected Versions Roche Accu-Chek Inform II Base Unit / Base Unit Hub versions prior to 03.01.04 Roche CoaguChek / cobas h232 Handheld Base Unit versions prior to 03.01.04 Description The issue is related to insecure permissions in a service interface, which ma...

Dell OpenManage Network Manager MySQL vulnerability

Added: 11/20/2018 BID: 105912 Background Dell OpenManage Network Manager is a product for monitoring and managing network devices. Problem Dell OpenManage Network Manager runs the MySQL database service with root privileges and enables default database accounts, allowing a remote attacker to writ...

Nagios XI Arbitrary Command Execution Vulnerability

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An arbitrary command execution vulnerability exists in Nagios XI 5.5.6. A remote authenticated attacker can exploit this vulnerability...

PT-2018-2699

Name of the Vulnerable Software and Affected Versions Bash versions prior to 4.4-beta2 Description The issue is related to the restricted command interpreter rbash in Bash, which is associated with insufficient checking of the BASH CMDS array values. This could allow an attacker to execute...

[ASA-201811-14] patch: multiple issues

Arch Linux Security Advisory ASA-201811-14 ========================================== Severity: High Date : 2018-11-12 CVE-ID : CVE-2018-6952 CVE-2018-1000156 Package : patch Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-808 Summary ======= The package patch before...

Brocade Fabric OS Arbitrary Command Execution Vulnerability

Fabric OS is the firmware for Brocade Communications Systems' Fibre Channel switches and Fibre Channel controllers. An arbitrary command execution vulnerability exists in the Brocade Webtools firmware update section of Brocade Fabric OS prior to 8.2.1, 8.1.2f, 8.0.2f, and 7.4.2d. A remote...

CVE-2018-15381 Cisco Unity Express Arbitrary Command Execution Vulnerability

A Java deserialization vulnerability in Cisco Unity Express CUE could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

Foscam Opticam i5 Arbitrary OS Command Execution Vulnerability

Foscam Opticam i5 is an IP camera from FOSCAM. An arbitrary OS command execution vulnerability exists in the ONVIF devicemgmt SetDNS method of the Foscam Opticam i5 with system firmware 1.5.2.11 and application firmware 2.21.1.128. A remote attacker could exploit this vulnerability to execute...

Roche Accu-Chek Inform II Base Unit/Base Unit Hub and CoaguChek/cobas h232 Handheld Base Unit License Issue Vulnerability

The Roche Accu-Chek Inform II Base Unit/Base Unit Hub and the CoaguChek/cobas h232 Handheld Base Unit are handheld blood testing medical devices from Roche, Switzerland. An authorization issue vulnerability exists in the Roche Accu-Chek Inform II Base Unit/Base Unit Hub versions prior to 03.01.04...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities affecting Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the following Cisco Security Advisories and apply the necessa...