Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak Vulnerability

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected. Title: Barracuda WAF Management Application Username and Session ID Leak 1. Vulnerability Details Affected Vendor: Barracuda Affected Product: Web...

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak

KL-001-2017-013 : Barracuda WAF Management Application Username and Session ID Leak Title: Barracuda WAF Management Application Username and Session ID Leak Advisory ID: KL-001-2017-013 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-013.tx...

Barracuda WAF V360 Firmware 8.0.1.014 Grub Password Complexity

KL-001-2017-012 : Barracuda WAF Grub Password Complexity Title: Barracuda WAF Grub Password Complexity Advisory ID: KL-001-2017-012 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-012.txt 1. Vulnerability Details Affected Vendor: Barracuda...

Barracuda WAF Management Application Username and Session ID Leak

Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded Linux CWE Classification: CWE-200: Information Exposure Impact: Privileged Access Attack vector: HTTP 2. Vulnerability Description The...

Barracuda WAF V360 Firmware 8.0.1.014 Early Boot Root Shell

KL-001-2017-010 : Barracuda WAF Early Boot Root Shell Title: Barracuda WAF Early Boot Root Shell Advisory ID: KL-001-2017-010 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-010.txt 1. Vulnerability Details Affected Vendor: Barracuda Affect...

Barracuda WAF Early Boot Root Shell

Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded Linux CWE Classification: CWE-489: Leftover Debug Code Impact: Root Access Attack vector: Grub 2. Vulnerability Description Firmware reversing...

Barracuda WAF Grub Password Complexity

Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded Linux CWE Classification: CWE-259: Use of Hard-coded Password Impact: Privileged Access Attack vector: Password Cracking 2. Vulnerability...

Solarwinds LEM 6.3.1 Sudo Script Abuse Privilege Escalation Vulnerability

An attacker can abuse functionality provided by a script which may be run with root privilege in order to elevate privilege on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1. Solarwinds LEM Privilege Escalation via Sudo Script Abuse Title: Solarwinds LEM Privilege Escalation via...

Solarwinds LEM 6.3.1 Sudo Privilege Escalation Vulnerability

Due to lax filesystem permissions, an attacker can take control of a hardcoded sudo path in order to execute commands as a privileged user on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1. Solarwinds LEM Privilege Escalation via Controlled Sudo Path Title: Solarwinds LEM...

Solarwinds LEM 6.3.1 Hardcoded Credentials Vulnerability

The Postgres database on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1 has default hardcoded credentials. While some security measures were taken to ensure that network connectivity to the Postgres database wouldn't be possible using IPv4, the same measures were not taken for...

Solarwinds LEM Privilege Escalation via Controlled Sudo Path

Vulnerability Details Affected Vendor: Solarwinds Affected Product: Log and Event Manager Virtual Appliance Affected Version: v6.3.1 Platform: Embedded Linux CWE Classification: CWE-281: Improper Preservation of Permissions, CWE-708: Incorrect Ownership Assignment Impact: Privileged Access...

Solarwinds LEM 6.3.1 Hardcoded Credentials

KL-001-2017-009 : Solarwinds LEM Database Listener with Hardcoded Credentials Title: Solarwinds LEM Database Listener with Hardcoded Credentials Advisory ID: KL-001-2017-009 Publication Date: 2017.04.24 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-009.txt 1...

Solarwinds LEM 6.3.1 Sudo Privilege Escalation

KL-001-2017-005 : Solarwinds LEM Privilege Escalation via Controlled Sudo Path Title: Solarwinds LEM Privilege Escalation via Controlled Sudo Path Advisory ID: KL-001-2017-005 Publication Date: 2017.04.24 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-005.txt 1...

Trendmicro InterScan 6.5-SP2_Build_Linux_1548 Remote Root Vulnerability

Exploit for windows platform in category remote exploits Title: Trendmicro InterScan Remote Root Access Vulnerability Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-003.txt 1. Vulnerability Details Affected Vendor: Trendmicro Affected Product: InterScan Web Security...

Trendmicro InterScan Remote Root Access Vulnerability

Vulnerability Details Affected Vendor: Trendmicro Affected Product: InterScan Web Security Virtual Appliance Affected Version: OS Version 3.5.1321.el6.x8664; Application Version 6.5-SP2BuildLinux1548 Platform: Embedded Linux CWE Classification: CWE-22: Improper Limitation of a Pathname to a...

Sophos Web Appliance 4.2.1.3 - Remote Code Execution

Sophos Web Appliance 4.2.1.3 - Remote Code Execution KL-001-2016-009 : Sophos Web Appliance Remote Code Execution Title: Sophos Web Appliance Remote Code Execution Advisory ID: KL-001-2016-009 Publication Date: 2016.11.03 Publication URL:...

Sophos Web Appliance 4.2.1.3 Remote Code Execution

KL-001-2016-009 : Sophos Web Appliance Remote Code Execution Title: Sophos Web Appliance Remote Code Execution Advisory ID: KL-001-2016-009 Publication Date: 2016.11.03 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-009.txt 1. Vulnerability Details Affected Vendor:...

Sophos Web Appliance Remote Code Execution

Vulnerability Details Affected Vendor: Sophos Affected Product: Web Apppliance Affected Version: v4.2.1.3 Platform: Embedded Linux CWE Classification: CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection', CWE-88: Argument Injection or Modification...

Cisco Firepower Threat Management Console 6.0.1 - Hard-Coded MySQL Credentials Vulnerability

Exploit for linux platform in category local exploits Cisco Firepower Threat Management Console Hard-coded MySQL Credentials Title: Cisco Firepower Threat Management Console Hard-coded MySQL Credentials Advisory ID: KL-001-2016-005 Publication Date: 2016.10.05 Publication URL:...

Cisco Firepower Threat Management Console 6.0.1 - Local File Inclusion

Cisco Firepower Threat Management Console 6.0.1 - Local File Inclusion KL-001-2016-006 : Cisco Firepower Threat Management Console Local File Inclusion Title: Cisco Firepower Threat Management Console Local File Inclusion Advisory ID: KL-001-2016-006 Publication Date: 2016.10.05 Publication URL:...