CVE-2018-12980

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server...

CVE-2018-13796

An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...

CVE-2018-12981

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be...

CVE-2018-12979

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM...

Unrestricted file upload

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM...

CVE-2018-12979

Affected product/versions: WAGO e!DISPLAY 762-3000 to 762-3003 with firmware before 02. Vulnerability: CVE-2018-12979, Incorrect default/critical resource permissions, enabling an authenticated user to overwrite files via the WBM upload path. Impact (per sources): potential unauthorized modificat...

CVE-2018-12979

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM...

CVE-2018-12980

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server...

CVE-2018-12981

WAGO e!DISPLAY 762-3000 to 762-3003 (firmware pre FW 02) are affected by CVE-2018-12981. Authenticated and unauthenticated users can send crafted requests to the device’s web server to inject/execute script within the WBM browser context (Stored and Reflected XSS in the admin/web interface). Impa...

CVE-2018-13796

Removed by vendor...

CVE-2018-12981

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be...

CVE-2018-12980

The connected ICS advisory confirms CVE-2018-12980 (Unrestricted Upload of File with Dangerous Type) affects WAGO e!DISPLAY 762-3000/762-3003 devices with FW 01 firmware; FW 02 is the fixed version. An authenticated user can upload arbitrary files to the file system with the web server’s permissi...

WAGO e!DISPLAY 7300T XSS / File Upload / Code Execution Vulnerabilities

WAGO e!DISPLAY 7300T WP 4.3 480x272 PIO1 version FW 01 - 01.01.1001 suffer from code execution, cross site scripting, weak permission, and remote file upload vulnerabilities. ======================================================================= title: Remote code execution via multiple attack...

Remote code execution via multiple attack vectors in WAGO e!DISPLAY 7300T

VENDOR DESCRIPTION “New ideas are the driving force behind our success WAGO is a family-owned company headquartered in Minden, Germany. Independently operating for three generations, WAGO is the global leader of spring pressure electrical interconnect and automation solutions. For more than 60...

Microsoft Edge CWUCLayer Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the routines that...

CVE-2018-8306

A command injection vulnerability exists in the Microsoft Wireless Display Adapter MWDA when the Microsoft Wireless Display Adapter does not properly manage user input, aka "Microsoft Wireless Display Adapter Command Injection Vulnerability." This affects Microsoft Wireless Display Adapter V2...

CVE-2018-8306

A command injection vulnerability exists in the Microsoft Wireless Display Adapter MWDA when the Microsoft Wireless Display Adapter does not properly manage user input, aka "Microsoft Wireless Display Adapter Command Injection Vulnerability." This affects Microsoft Wireless Display Adapter V2...

Command injection

A command injection vulnerability exists in the Microsoft Wireless Display Adapter MWDA when the Microsoft Wireless Display Adapter does not properly manage user input, aka "Microsoft Wireless Display Adapter Command Injection Vulnerability." This affects Microsoft Wireless Display Adapter V2...

CVE-2018-8306

A command injection vulnerability exists in the Microsoft Wireless Display Adapter MWDA when the Microsoft Wireless Display Adapter does not properly manage user input, aka "Microsoft Wireless Display Adapter Command Injection Vulnerability." This affects Microsoft Wireless Display Adapter V2...

WAGO e!DISPLAY 7300T XSS / File Upload / Code Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote code execution via multiple attack vectors product: WAGO e!DISPLAY 7300T - WP 4.3 480x272 PIO1 vulnerable version: FW 01 - 01.01.1001 fixed version: FW 02 CVE...