Authentication flaw

Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication...

CVE-2018-11635

Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication...

CVE-2018-11641

Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service...

CVE-2018-11639

Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext...

CVE-2018-11637

Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbitrary files from the /var/ directory because a symlink exists under the web root...

CVE-2018-11641

Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service...

CVE-2018-11637

Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbitrary files from the /var/ directory because a symlink exists under the web root...

CVE-2018-11643

CVE-2018-11643 affects Dialogic PowerMedia XMS (administrative console) and enables SQL injection via the filterPattern parameter. According to the CVE description, the vulnerability allows remote authenticated users to execute arbitrary SQL commands. The issue is stated to affect PowerMedia XMS ...

10 Endpoint Security Problems Solved by the Cloud – Managing Multiple Agents

So far in this blog series, we’ve discussed the state of endpoint security, and the challenges of keeping systems up to date and integrating multiple products. This installment will take a look at how the cloud solves our third challenge: managing multiple agents. Too Much To Keep Track Of A good...

CVE-2018-1212 Authenticated remote code execution in iDRAC 6

The web-based diagnostics console in Dell EMC iDRAC6 Monolithic versions prior to 2.91 and Modular all versions contains a command injection vulnerability. A remote authenticated malicious iDRAC user with access to the diagnostics console could potentially exploit this vulnerability to execute...

Command injection

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability both on the server and on devices by sending malformed parameters in sensor or...

CVE-2018-9276

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability both on the server and on devices by sending malformed parameters in sensor or...

Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution Vulnerability

Exploit for linux platform in category local exploits Exploit Title: Dell EMC RecoverPoint &2 email protected:/ id uid=0root gid=0root groups=0root email protected:/ 0day.today 2018-06-22...

CVE-2018-1254

RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim Security Console administrator to supply malicious HTML or...

CVE-2018-1253

RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When oth...

CVE-2018-1254

RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim Security Console administrator to supply malicious HTML or...

CVE-2018-1253

CVE-2018-1253 : RSA Authentication Manager Operation Console, version 8.3 P1 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the web interface. A malicious Operations Console administrator could store arbitrary HTML/JavaScript, which may be executed in other Administrat...

CVE-2018-1254

The CVE-2018-1254 entry concerns RSA Authentication Manager Security Console, 8.3 P1 and earlier, with a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could trick a Console administrator into submitting malicious HTML or JavaScript to the vulnerable web app, whic...

Dell EMC RecoverPoint 5.1.2 - Local Root Command Execution

Dell EMC RecoverPoint 5.1.2 - Local Root Command Execution Exploit Title: Dell EMC RecoverPoint &2 root@recoverpoint:/ id uid=0root gid=0root groups=0root root@recoverpoint:/...

CVE-2018-1073

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...