12615 matches found
Sony IPELA ENGINE IP Cameras Backdoor Accounts Vulnerability
Sony IPELA ENGINE IP Cameras contain multiple backdoors that, among other functionality, allow an attacker to enable the Telnet/SSH service for remote administration over the network. Other available functionality may have undesired effects to the camera image quality or other camera functionalit...
Debian DLA-734-1 : mapserver security update
It was discovered that there was an information leakage vulnerability in mapserver, a CGI-based framework for Internet map services. For Debian 7 'Wheezy', this issue has been fixed in mapserver version 6.0.1-3.2+deb7u3. We recommend that you upgrade your mapserver packages. NOTE: Tenable Network...
Sony IPELA ENGINE IP Cameras Backdoor Accounts
We have published an accompanying blog post to this technical advisory with further information: http://blog.sec-consult.com/2016/12/backdoor-in-sony-ipela-engine-ip-cameras.html SEC Consult Vulnerability Lab Security Advisory ======================================================================...
mail.nycgreen.org XSS vulnerability
Open Bug Bounty ID: OBB-196603 Description| Value ---|--- Affected Website:| mail.nycgreen.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Ubuntu 14.04 LTS / 16.04 LTS : Python vulnerabilities (USN-3134-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3134-1 advisory. It was discovered that the smtplib library in Python did not return an error when StartTLS fails. A remote attacker could possibly use this t...
USN-3134-1: Python vulnerabilities
It was discovered that the smtplib library in Python did not return an error when StartTLS fails. A remote attacker could possibly use this to expose sensitive information. CVE-2016-0772 Rémi Rampin discovered that Python would not protect CGI applications from contents of the HTTPPROXY environme...
tomcat security, bug fix, and enhancement update
0:7.0.69-10 - Related: rhbz1368122 0:7.0.69-9 - Resolves: rhbz1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz1368122 0:7.0.69-7 - Resolves: rhbz1362545 0:7.0.69-6 - Related: rhbz1201409 Added /etc/sysconfig/tomcat to the systemd unit fo...
NETGEAR JNR1010 ADSL Router - (Authenticated) Remote File Disclosure
NETGEAR JNR1010 ADSL Router - Authenticated Remote File Disclosure !/bin/sh NETGEAR ADSL ROUTER JNR1010 1.0.0.16 Authenticated Remote File Disclosure Hardware Version: JNR1010 Firmware Version: 1.0.0.16 GUI Language Version: 1.0.0.16 Copyright 2016 c Todor Donev https://www.ethical-hacker.org/...
MOVISTAR BHS_RTA ADSL Router - Remote File Disclosure
!/bin/sh MOVISTAR ADSL ROUTER BHSRTA BHSRTAC0019 Remote File Disclosure Vendor: OBSERVA Model: BHSRTA Software: BHSRTACO019 Firmware: 09/08/2012-10:23:25 Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous programs is...
track.trafficholder.com Open Redirect vulnerability
Open Bug Bounty ID: OBB-191310 Description| Value ---|--- Affected Website:| track.trafficholder.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Shee...
PT-2016-3222
Name of the Vulnerable Software and Affected Versions dnaLIMS version 4-2015s13 Description The issue concerns an improperly protected administrative web shell, allowing unauthenticated command execution. This can be exploited through cgi-bin/dna/sysAdmin.cgi using specially crafted POST requests...
SQL Injection Vulnerability in Digital China Internet Behavior Management System's cgi_div_id Parameter
Digital China Internet Behavior Management System is an Internet behavior logging system that fully owns the network behavior analysis management system, integrating hardware and software architecture, behavior analysis engine, management and control policies, analyzing network activities in real...
SunellSecurity NVR / Camera - Denial Of Service
Exploit for hardware platform in category dos / poc Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI Date: 11.2.2016 Exploit Author: qwsj Vendor Homepage: https://github.com/qwsj Version: 1.6.08-09 / 2.0.06-08 Tested on: Windows / Linux Bug in CGI scrypt's for develop. Web servic...
SunellSecurity NVR / Camera 1.6.08-09 / 2.0.06-08 Denial Of Service
Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI Date: 11.2.2016 Exploit Author: qwsj Vendor Homepage: https://github.com/qwsj Version: 1.6.08-09 / 2.0.06-08 Tested on: Windows / Linux Bug in CGI scrypt's for develop. Web service buffer overflow and leading to a stop web service,...
SunellSecurity NVR Camera - Denial of Service
SunellSecurity NVR Camera - Denial of Service Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI Date: 11.2.2016 Exploit Author: qwsj Vendor Homepage: https://github.com/qwsj Version: 1.6.08-09 / 2.0.06-08 Tested on: Windows / Linux Bug in CGI scrypt's for develop. Web service buff...
SunellSecurity NVR / Camera - Denial of Service
Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI Date: 11.2.2016 Exploit Author: qwsj Vendor Homepage: https://github.com/qwsj Version: 1.6.08-09 / 2.0.06-08 Tested on: Windows / Linux Bug in CGI scrypt's for develop. Web service buffer overflow and leading to a stop web service,...
[ASA-201611-6] tomcat6: proxy injection
Arch Linux Security Advisory ASA-201611-6 ========================================= Severity: Medium Date : 2016-11-02 CVE-ID : CVE-2016-5388 Package : tomcat6 Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat6 before version...
F5 Networks BIG-IP : pcregrep in PCRE vulnerability (K05428062)
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client. CVE-2015-8393 C Tenable Network Security, Inc. The descriptive text an...
