PT-2018-13586

Name of the Vulnerable Software and Affected Versions libnmapp versions prior to 0.4.16 libnmap versions prior to 0.4.16 Description A command injection issue allows arbitrary commands to be executed via arguments to the range options. This can be exploited by passing malicious input to the range...

Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801r

Summary Summary AT&T has released version 1801r for the Vyatta 5600. Advisory CVEs: CVE-2018-10860 CVE-2018-16741 CVE-2018-14618 CVE-2018-15473 CVE-2018-5391 CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682 Details of this release can be found at...

WebEx Local Service Permissions Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebEx Local Service Permissions Exploit', 'Description' = %q This module exploits a flaw in the 'webexservice' Windows service, which runs as...

PT-2018-11610

Name of the Vulnerable Software and Affected Versions KERUI Wifi Endoscope Camera YPC99 affected versions not specified Description The issue concerns missing authentication and improper input validation, allowing an attacker to execute arbitrary commands with a length limit of 19 characters via...

CVE-2018-13114: Missing Authentication for Critical Function

Missing authentication and improper input validation in KERUI Wifi Endoscope Camera YPC99 allow an attacker to execute arbitrary commands with a length limit of 19 characters via the "ssid" value, as demonstrated by ssid:;ping 192.168.1.2 in the body of a SETSSID command...

IPFire Firewall Command Injection Vulnerability

IPFire Firewall is an open source Linux-based firewall system . A command injection vulnerability exists in the backup.cgi file in versions prior to IPFire Firewall 2.21 Core Update 124, which can be exploited by an attacker to execute arbitrary commands...

CVE-2018-16232: Improper Neutralization of Special Elements used in an OS Command

An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands...

Teltonika RUT9XX Arbitrary Command Execution Vulnerability

Teltonika RUT9XX routers also known as LuCI is a router product from the Lithuanian company Teltonika. An arbitrary command execution vulnerability exists in Teltonika RUT9XX with firmware version lower than 00.04.233, which is caused by the program's failure to perform proper access control and...

Multiple vulnerabilities in FileZen

Overview FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains multiple vulnerabilities listed below. Directory traversal CWE-22 - CVE-2018-0693 OS command injection CWE-78 - CVE-2018-0694 Soliton Systems K.K...

CVE-2018-12441

The CorsairService in Corsair Utility Engine has insecure default permissions: the Everyone group is granted SERVICE_ALL_ACCESS, enabling unprivileged local users to modify CorsairService BINARY_PATH_NAME and execute arbitrary commands, resulting in complete control of the system. Connected docum...

Cisco Identity Services Engine WEB Management Interface Arbitrary Command Execution Vulnerability

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A security vulnerability...

[ASA-201810-8] patch: multiple issues

Arch Linux Security Advisory ASA-201810-8 ========================================= Severity: High Date : 2018-10-09 CVE-ID : CVE-2018-6951 CVE-2018-6952 CVE-2018-1000156 Package : patch Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-619 Summary ======= The package...

CVE-2018-15427: Use of Hard-coded Credentials

A vulnerability in Cisco Video Surveillance Manager VSM Software running on certain Cisco Connected Safety and Security Unified Computing System UCS platforms could allow an unauthenticated, remote attacker to log in to an affected system by using the root account, which has default, static user...

PT-2018-2016

Name of the Vulnerable Software and Affected Versions Cisco Video Surveillance Manager VSM Software affected versions not specified Description A vulnerability in the software could allow an unauthenticated, remote attacker to log in to an affected system by using the root account, which has...

Cisco Video Surveillance Manager Device Default Password Vulnerability

Cisco Video Surveillance Operations Manager is an enterprise-class video configuration and management solution. A device default password vulnerability exists in Cisco Video Surveillance Manager due to the presence of undocumented default static user credentials for the root account of the affect...

ProtonVPN Software Command Injection

The vulnerability of ProtonVPN’s software for accessing VPN services arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or code with SYSTEM privilege...

Design/Logic Flaw

nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call...

CVE-2018-17228

nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call...

CVE-2018-17228

nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call...

PT-2018-13954

Name of the Vulnerable Software and Affected Versions nmap4j version 1.1.0 Description The issue allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call. Recommendations For nmap4j version 1.1.0, consider restricting the use of the includeHosts call until a...