CVE-2020-10797

An XSS vulnerability resides in the hostname field of the diagping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed...

CVE-2020-10797

An XSS vulnerability resides in the hostname field of the diagping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed...

CVE-2020-10797

An XSS vulnerability resides in the hostname field of the diagping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed...

PT-2020-12330

Name of the Vulnerable Software and Affected Versions pfsense versions prior to 2.4.5 Description The issue is related to an XSS vulnerability in the hostname field of the diag ping.php page. It occurs when inputs are passed to a command and executed, resulting in the $result variable being print...

CVE-2020-10797: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability resides in the hostname field of the diagping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed...

CVE-2020-7350

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to b...

Command injection

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to b...

CVE-2020-7350

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to b...

CVE-2020-7350 Metasploit Framework Plugin Libnotify Command Injection

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to b...

ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution

The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted hostname. Applications using these vulnerable utilities with an untrusted input may be potentially exploited, resulting in a crash or arbitrary code execution under...

Ubiquiti Networks UniFi Cloud Key Authorization Issue Vulnerability

Ubiquiti Networks UniFi Cloud Key is a secret key device that supports management of UniFi networks from Ubiquiti Networks USA. An authorization issue vulnerability exists in the Ubiquiti Networks UniFi Cloud Key Gen2 and UniFi Cloud Key Gen2 Plus using firmware versions prior to 1.1.6. An attack...

CVE-2020-8148

UniFi Cloud Key firmware 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus...

CVE-2020-8148

UniFi Cloud Key firmware 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus...

Design/Logic Flaw

UniFi Cloud Key firmware 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus...

CVE-2020-8148

UniFi Cloud Key firmware 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus...

CVE-2020-8148

UniFi Cloud Key firmware 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus...

CVE-2020-8148

CVE-2020-8148 affects Ubiquiti UniFi Cloud Key Gen2 and Gen2 Plus prior to firmware version 1.1.6. The issue is described as an authorization/unauthorized API request vulnerability that enables an attacker to change a device hostname by sending a crafted API request. Impact is limited to hostname...

CVE-2020-8148: Improper Authentication

UniFi Cloud Key firmware 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus...

PT-2020-19983

Name of the Vulnerable Software and Affected Versions UniFi Cloud Key firmware versions prior to 1.1.6 Description The issue allows an attacker to change a device hostname by sending a malicious API request, affecting Cloud Key gen2 and Cloud Key gen2 Plus. Recommendations For versions prior to...

Arbitrary Code Execution

dhcp is vulnerable to arbitrary code execution. It was discovered that the DHCP client daemon, dhclient, did not sufficiently sanitize certain options provided in DHCP server replies, such as the client hostname. A malicious DHCP server could send such an option with a specially-crafted value to ...