CVE-2017-12335

The CVE-2017-12335 issue is a Cisco NX-OS System Software CLI command-injection vulnerability caused by insufficient input validation. It affects multiple Nexus/NX-OS platforms (e.g., Multilayer Director Switches, Nexus 2000/3000/5000/5500/5600/6000/7000/9000 series, Nexus 9500 R, and UCS Manager...

CVE-2017-12341

CVE-2017-12341 affects Cisco NX-OS System Software CLI. The issue arises from insufficient input validation during patch image installation, allowing an authenticated local attacker with valid admin credentials to execute arbitrary commands as root prior to patch activation. Affected platforms in...

CVE-2017-12334

Cisco NX-OS System Software CLI Command Injection vulnerability (CVE-2017-12334) affects multiple Cisco NX-OS platforms (e.g., Multilayer Director Switches, Nexus 2000/3000/3500/5000/5500/5600/6000/7000/7700/9000 series and UCS Manager). Root cause: insufficient input validation of CLI command ar...

CVE-2017-12339

Summary: CVE-2017-12339 is a vulnerability in the CLI of Cisco NX-OS System Software that allows an authenticated, local attacker to perform a command injection due to insufficient input validation of CLI command arguments. The attacker could inject crafted arguments to execute arbitrary commands...

CVE-2017-12329

CVE-2017-12329 describes a local command-injection vulnerability in the CLI of Cisco Firepower FXOS and NX-OS System Software caused by insufficient input validation of CLI arguments. An authenticated, local attacker could inject crafted arguments to execute arbitrary commands at the attacker’s p...

CVE-2017-12330

CVE-2017-12330 affects Cisco NX-OS System Software by a CLI command-injection vulnerability caused by insufficient input validation of command arguments to the CLI parser. An authenticated, local attacker could inject crafted arguments via vulnerable CLI commands to execute arbitrary commands wit...

Cisco Nexus Series Switches CLI Command Injection Vulnerability

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting...

Cisco NX-OS System Software CLI Arbitrary File Read Vulnerability

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerability is due to insufficient input validation for a specific CLI command. An attacker could exploit this vulnerability by issuing a crafted...

Cisco FXOS and NX-OS System Software CLI Command Injection Vulnerability

A vulnerability in the CLI of Cisco Firepower Extensible Operating System FXOS and NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacke...

DBC2 (DropboxC2) - A Modular Post-Exploitation Tool, Composed Of An Agent Running On The Victim'S Machine

DBC2 DropboxC2 is a modular post-exploitation tool, composed of an agent running on the victim's machine, a controler, running on any machine, powershell modules, and Dropbox servers as a means of communication. This project was initially inspired by the fantastic Empire framework, but also as an...

pcc - PHP Secure Configuration Checker

Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful tasks. Idea one single file for ea...

Input validation

A vulnerability in the restricted shell of the Cisco Identity Services Engine ISE that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI...

CVE-2017-12261

A vulnerability in the restricted shell of the Cisco Identity Services Engine ISE that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI...

CVE-2017-12261

A vulnerability in the restricted shell of the Cisco Identity Services Engine ISE that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI...

CVE-2017-12261

The CVE-2017-12261 issue is a vulnerability in the restricted shell of Cisco Identity Services Engine (ISE) that allows an authenticated, local attacker to run arbitrary CLI commands with elevated privileges due to incomplete input validation of CLI inputs. It affects ISE products released in 1.4...

Social Engineering Framework: Cartero

A robust Phishing Framework with a full featured CLI interface. The project was born out necessity through of years of engagements with tools that just didn’t do the job. Even though there are many projects out there, we were not able to find a suitable solution that gave us both easy of use and...

Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerabilities (USN-3471-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3471-1 advisory. Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker could possibly use this issue to caus...

Ubuntu: Security Advisory (USN-3471-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Starting/stopping Amazon EC2 instances using CLI and Python SDK

It's a very good practice to scan your perimeter from the outside of your network, simulating an attacker. However, you will need to deploy the scanners somewhere to do this. Hosting on Amazon EC2 can be a good and cost-effective option, especially if you start instances with vulnerability scanne...

USN-3471-1: Quagga vulnerabilities

Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service. CVE-2017-16227 Quentin Young discovered that Quagga incorrectly handled memory in the telnet vty CLI. A...