CVE-2018-7210: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLicense URI, as demonstrated by intranet IP addresses and names of guest accounts...

PT-2018-17951

Name of the Vulnerable Software and Affected Versions iDashboards version 9.6b Description An issue allows remote attackers to obtain sensitive information via a direct request for the "idb/config?CMD=installLicense" URI. This can be demonstrated by accessing intranet IP addresses and names of...

PT-2018-17538

Name of the Vulnerable Software and Affected Versions Conceptronic CIPCAMPTIWL V3 version 0.61.30.21 Description An issue allows an unauthenticated attacker to crash a device by sending a POST request with a large body size to the "hy-cgi/devices.cgi?cmd=searchlandevice" endpoint. This results in...

CVE-2018-6407: Improper Input Validation

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...

ILIAS Cross-Site Scripting Vulnerability (CNVD-2018-03162)

ILIAS is a Web-based learning management system developed by the ILIAS team. The system contains modules for course management, file sharing, and live chat. A cross-site scripting vulnerability exists in ILIAS. A remote attacker can exploit this vulnerability by sending a 'cmd' parameter to the...

ILIAS < 5.2.4 XSS Vulnerability

ILIAS eLearning is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Linux/x86-64 - Add User (pwned/$pass$) Using echo cmd Shellcode (273 bytes)

; shellcode name adduserpassword ; Author : Christophe G SLAE64-1337 ; Len : 273 bytes ; Language : Nasm ; "name = pwned ; pass = $pass$" ; add user and password with echo cmd ; tested kali linux , kernel 3.12 global start start: jmp short findaddress realstart: pop rdi xor byte rdi + 7 , 0x41 ;...

CVE-2018-5688: Improper Neutralization of Input During Web Page Generation

ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component...

PT-2018-17085

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 5.2.4 Description: The issue concerns a problem with the displayHeader function in the Setup component, specifically in the setup/classes/class.ilSetupGUI.php file. It allows for XSS via the cmd parameter...

CVE-2017-17106: Insufficiently Protected Credentials

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages...

Failed to import Veeam Cloud Connect certificate after Veeam Availability Console server migration

Challenge After migrating your Veeam Availability Console VAC installation to a new server and adding an existing Veeam Cloud Connect VCC server, the following certificate error may be observed: Failed to import certificate from the Veeam Cloud Connect server. See debug logs for more information...

DiskBoss Enterprise 8.4.16 - Local Buffer Overflow

DiskBoss Enterprise 8.4.16 - Local Buffer Overflow !/usr/bin/python ======================================================================================================================== Exploit Author: C4t0ps1s Exploit Title: DiskBoss Enterprise v8.4.16 Local Buffer OverflowCode execution Date...

D-Link Router Cmd Authentication Bypass

The vulnerability of the cmd parameter in D-Link DNS-320L, D-Link DNS-327L, D-Link DNR-326, D-Link DNS-320B, D-Link DNS-345, D-Link DNS-325, and D-Link DNS-322L routers is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass...

Easy Video to iPod/MP4/PSP/3GP Converter 1.5.20 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: Easy Video to iPod/MP4/PSP/3GP Converter 1.5.20 - 'Enter User Name' Field Buffer Overflow SEH Date: 24-08-2017 Exploit Author: Anurag Srivastava Website: www.pyramidcyber.com Vulnerable Software: Easy Video to iPod/MP4/PSP/3GP Converter Vendor Homepage:...

PT-2017-3646

Name of the Vulnerable Software and Affected Versions: Android versions 8.0, 8.1 Description: The issue is caused by a possible stack buffer overflow due to an incorrect bounds check in the avrc pars browsing cmd function of avrc pars tg.cc. This could lead to remote code execution with no...

RubyMine 2016.1 - CMD Manual Buffer Overflow Exploitation

Document Title: =============== RubyMine 2016.1 - CMD Manual Buffer Overflow Exploitation References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2089 Video: https://www.youtube.com/watch?v=4Sk0rq1Z8Qk Release Date: ============= 2017-08-18 Vulnerability Laboratory ID VL-ID:...

RubyMine 2016.1 - CMD Manual Buffer Overflow Exploitation

Document Title: =============== RubyMine 2016.1 - CMD Manual Buffer Overflow Exploitation References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2089 Video: https://www.youtube.com/watch?v=4Sk0rq1Z8Qk Release Date: ============= 2017-08-17 Vulnerability Laboratory ID VL-ID:...

CVE-2017-11589

On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is no access control for info.html, wancfg.cmd, rtroutecfg.cmd, arpview.cmd, cpuview.cmd, memoryview.cmd, statswan.cmd,...

Metasploit RPC Console Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/rpc/v10/client' class MetasploitModule 'Metasploit RPC Console Command Execution', 'Description' = %q This module connects to a specified Metasploit RPC...

Metasploit RPC Console Command Execution Exploit

This Metasploit module connects to a specified Metasploit RPC server and uses the 'console.write' procedure to execute operating system commands. Valid credentials are required to access the RPC interface. This Metasploit module has been tested successfully on Metasploit 4.15 on Kali 1.0.6;...