Ubiquiti Inc.: Wordpress directories/files visible to internet

Issue During my testing I noticed that ubnt website https://directory.corp.ubnt.com seems to leak some data into internet. Wordpress directory https://directory.corp.ubnt.com/wp-content/uploads/ is showing files which I suppose shouldn't be visible to internet. I noticed that these files include...

Ubiquiti Inc.: Can upload files without authentication on AirFibre 3.2

A POST submission such as below will upload a file to the tmp/upload directory without requiring authentication. I have been unable to redirect the upload to another directory so cannot utilize for RCE however an attacker is able to use this to fill the disk space on the device which could cause ...

Ubiquiti Inc.: [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users

The researcher found a privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allowing an operator user Privilege-1 to escalate privileges and became administrator Privilege-15. OS command injection i...

AMI BIOS SMM Code Execution Vulnerability

Lenovo Security Advisory: LEN-4710 Potential Impact: Execution of code in SMM by an attacker with administrative access Severity: Medium Scope of impact: Industry-wide Summary Description: System Management Mode SMM is the most privileged execution mode of the x86 processor. Software System...

Dell SonicWALL Network Security Appliance NSA 6600 XSS Vulnerability

Dell SonicWALL Network Security Appliance NSA 6600 suffers from a reflective cross site scripting vulnerability. Versions affected include NSA 6600 running SonicOS Enhanced 6.2.4.3-31n, WXA 4000 running 1.3.2.0-07, and SafeMode 6.1.0.11. i? Dell SonicWALL Network Security Appliance NSA 6600...

Dell SonicWALL Global Management System GMS 8.1 Cross Site Scripting Vulnerability

Dell SonicWALL Global Management System GMS version 8.1 suffers from multiple cross site scripting vulnerabilities. i? Dell SonicWALL Global Management System GMS 8.1 XSS Vulnerabilities Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/sonicwall-gms/ Affected version: 8.1 8....

Dell SonicWALL Global Management System GMS 8.1 Adobe Flex SOP Bypass Vulnerability

Dell SonicWALL GMS versions 8.1 and below are compiled with a vulnerable version of Adobe Flex SDK allowing for same-origin request forgery and cross-site content hijacking i? Dell SonicWALL Global Management System GMS 8.1 Adobe Flex SOP Bypass Vendor: Dell Inc. Product web page:...

Dell SonicWALL Secure Mobile Access SMA 8.1 - Cross-Site Scripting / Cross-Site Request Forgery

Exploit for hardware platform in category web applications Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/secure-mobile-access/ Affected version: 8.1 SSL-VPN Summary: Keep up with the demands of today’s remote...

Dell SonicWALL Global Management System GMS 8.1 - Blind SQL Injection Vulnerability

Exploit for hardware platform in category web applications Dell SonicWALL Global Management System GMS 8.1 Blind SQL Injection Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/sonicwall-gms/ Affected version: 8.1 8.0 SP1 Build 8048.1410 Flow Server Virtual Appliance Fixed in...

Dell SonicWALL Global Management System GMS 8.1 Cross Site Scripting

i? Dell SonicWALL Global Management System GMS 8.1 XSS Vulnerabilities Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/sonicwall-gms/ Affected version: 8.1 8.0 SP1 Build 8048.1410 Flow Server Virtual Appliance Analyzer Virtual Appliance Fixed in: 8.2 VR-2016-01-C1D Summary:...

Dell SonicWALL Global Management System GMS 8.1 XSS Vulnerabilities

Summary Provide your organization, distributed enterprise or managed service offering with an intuitive, powerful way to rapidly deploy and centrally manage SonicWall solutions, with SonicWall GMS. Get more value from your firewall, secure remote access, anti-spam, and backup and recovery solutio...

Dell SonicWALL Global Management System GMS 8.1 - Blind SQL Injection

Dell SonicWALL Global Management System GMS 8.1 Blind SQL Injection Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/sonicwall-gms/ Affected version: 8.1 8.0 SP1 Build 8048.1410 Flow Server Virtual Appliance Fixed in: 8.2 VR-2016-01-C0V Summary: Provide your organization,...

Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF

Summary Keep up with the demands of today’s remote workforce. Enable secure mobile access to critical apps and data without compromising security. Choose from a variety of scalable secure mobile access SMA appliances and intuitive Mobile Connect apps to fit every size business and budget...

Dell SonicWALL Global Management System GMS 8.1 Blind SQL Injection

Summary Provide your organization, distributed enterprise or managed service offering with an intuitive, powerful way to rapidly deploy and centrally manage SonicWall solutions, with SonicWall GMS. Get more value from your firewall, secure remote access, anti-spam, and backup and recovery solutio...

OWOX, Inc.: Stored XSS at https://finance.owox.com/customer/accountList

XSS on finance.owox.com instance POC: 1 Login to zhe site 2 Go to the https://finance.owox.com/customer/accountList 3 You will be XSSed immediately. Reproduce steps: 1 Go to the https://finance.owox.com/customer/accountAdd Place in the username next payload: "alertdocument.cookie; 3 Go to the...

Fedora 24 : kernel (2016-e5b72816d0)

The 4.8.14 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

JVN#12281353: Cybozu Garoon vulnerable to cross-site scripting

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains a cross-site scripting vulnerability CWE-79 due to an issue in "Messages" function of Cybozu Garoon Keitai. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the...

JVN#17980240: Cybozu Garoon vulnerable to SQL injection

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an SQL injection vulnerability CWE-89 due to an issue in "MultiReport" function. Impact A user may execute arbitrary SQL commands. Solution Update the Software Update to the latest version according to the information...

JVN#15222211: Cybozu Garoon vulnerable to cross-site request forgery

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, the user may be forced to log out. Solution Update the Software Update to the latest version according to the...

JVN#28151745: Sleipnir for Mac vulnerable to URL spoofing

Sleipnir for Mac provided by Fenrir Inc. contains a URL spoofing vulnerability due to a flaw in the page transition. Impact The displayed URL may be forged to conduct phishing attacks. Solution Update the Software Update to the latest version according to the information provided by the developer...