CVE-2019-12097

Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to code execution or local privilege escalation by replacing the original EnableLoopback.exe...

SUSE SLED15 / SLES15 Security Update : cf-cli (SUSE-SU-2019:1220-1)

"This update for cf-cli fixes the following issues : cf-cli was updated: to version 6.43.0 bsc1132242 Enhancements : cf curl supports a new --fail flag primarily for scripting purposes which returns exit code 22 for server errors story Improves cf delete-orphaned-routes such that it uses a...

openSUSE Security Update : chromium (openSUSE-2019-1324)

This update for chromium fixes the following issues : Security update to version 74.0.3729.108 boo1133313. Security issues fixed : - CVE-2019-5805: Use after free in PDFium - CVE-2019-5806: Integer overflow in Angle - CVE-2019-5807: Memory corruption in V8 - CVE-2019-5808: Use after free in Blink...

CVE-2019-3917

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on the router via a crafted HTTP request...

GPON Router Remote Unauthenticated Enable/Disable Telnet Service Vulnerability

GPON Gigabit-Capable PON technology is the latest generation of broadband passive optical integrated access standard based on the ITU-TG.984.x standard. Gigabit-Capable PON GPON technology is the latest generation of broadband passive optical integrated access standard based on ITU-TG.984.x...

CVE-2018-12237

The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious administrator with Enable mode access can execute arbitrary OS commands with elevated system privileges...

How to Enable SSL on Cloud Connectors to Secure XML Traffic

This article describes how to enable SSL on Cloud Connectors to secure XML traffic from the StoreFront server and how to configure your StoreFront site to secure the XML traffic...

Symantec (Blue Coat) Reporter CLI OS Command Injection Vulnerability (SYMSA1465)

According to its self-reported version number, the Symantec formerly Blue Coat Reporter installation running on the remote host is 10.1 prior to 10.1.5.6 or 10.2 prior to 10.2.1.8. It is, therefore, affected by an OS command injection vulnerability. An authenticated attacker with Enable mode...

Command Execution Vulnerability in Fusion K2 Wireless Router

The Fusion K2 Wireless Router is a wireless router for home use. A command execution vulnerability exists in the Fusion K2 Wireless Router, which stems from a failure to filter the timeRebootEnablestatus and timeRebootrange parameters, and can be exploited by an attacker to execute arbitrary...

PT-2019-6343 · D Link · Dir-868L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L Rev.B version 2.05B02 Description: The issue arises from the lack of proper sanitization of special elements in the AudioMute and AudioEnable parameters within the /HNAP1/SetClientInfoDemo message. This allows for command...

CVE-2018-15004

The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode versionCode=24, versionName=7.0 that contains an exported service app component named...

CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

UBUNTU-CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

DEBIAN-CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

Drobo 5N2 System Command Injection Vulnerability (CNVD-2019-05933)

The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A command injection vulnerability exists in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. An attacker can...

CVE-2018-14699

System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-17908

WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code...

Intelbras NPLUG Cross-Site Request Forgery Vulnerability

Intelbras NPLUG is a wireless relay device from Intelbras Poland. A cross-site request forgery vulnerability exists in the web interface in the Intelbras NPLUG version 1.0.0.14 wireless relay device. A remote attacker can use this vulnerability to modify the wireless SSID, reboot the device, edit...

Ektron CMS 9.20 SP2 - Improper Access Restrictions

Ektron CMS 9.20 SP2 - Improper Access Restrictions Details ================ Software: Ektron Content Management System CMS Version: 9.20 SP2 Homepage: https://www.episerver.com Advisory report: https://github.com/alt3kx/CVE-2018-12596 CVE: CVE-2018-12596 CVSS: 7.5 HIGH:...