CVE-2019-0065: Undefined Security Weakness

On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on MS-MIC or MS-MPC. By continuously sending a crafted SIP packet, an attacker can repeatedly bring down MS-PIC on MS-MIC/MS-MPC causing a sustained Denial of Service. This issue...

CVE-2019-0063: Undefined Security Weakness

When an MX Series Broadband Remote Access Server BRAS is configured as a Broadband Network Gateway BNG with DHCPv6 enabled, jdhcpd might crash when receiving a specific crafted DHCP response message on a subscriber interface. The daemon automatically restarts without intervention, but continuous...

CVE-2018-20916

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

CVE-2018-20916

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

Cross site scripting

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

CVE-2018-20916

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

CVE-2018-20916

CVE-2018-20916 affects cPanel prior to 70.0.23. The vulnerability is a Stored XSS in WHM via the Edit MX Entry, caused by lack of proper validation of client-side data in the web application. Impact stated as attacker-controlled scripts executed in the victim’s browser. Remediation: upgrade to 70...

CVE-2018-20916: Improper Neutralization of Input During Web Page Generation

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation

// Linux 4.10 // - added known helper paths // - added search for suitable helpers // - added automatic targeting // - changed target suid exectuable from passwd to pkexec // https://github.com/bcoles/kernel-exploits/tree/master/CVE-2019-13272 // --- // Tested on: // - Ubuntu 16.04.5 kernel...

CVE-2019-12502

There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI...

Cross site request forgery (csrf)

There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI...

CVE-2019-12502

The CVE-2019-12502 entry concerns MOBOTIX S14 MX-V4.2.1.61 cameras with a lack of CSRF countermeasures, demonstrated by the ability to add an admin account via the /admin/access URI. This is documented across multiple sources (NVD, Red Hat, Nessus plugin, etc.) and indicates a cross-site request ...

CVE-2019-6489

The vulnerability CVE-2019-6489 affects Lexmark devices: CX, MX, X, XC, XM, XS, and 6500e printers. The public description states that, prior to 2019-02-11, remote attackers could erase stored shortcuts, implying an issue with how input is handled by the device. Connected sources align on the sam...

CVE-2019-6489: Undefined Security Weakness

Certain Lexmark CX, MX, X, XC, XM, XS, and 6500e devices before 2019-02-11 allow remote attackers to erase stored shortcuts...

CVE-2019-7674

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. /admin/access accepts a request to set the "aaaaa" password, considered insecure for some use cases, from a user...

CVE-2019-7674

The CVE concerns MOBOTIX S14 MX-V4.2.1.61 devices where the /admin/access endpoint accepts a request to set the password to a fixed value (the string “aaaaa”). This represents an authentication weakness enabling password change by an authorized or potentially any user, depending on access control...

CVE-2019-7673: Use of a Broken or Risky Cryptographic Algorithm

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. Administrator Credentials are stored in the 13-character DES hash format...

CVE-2019-7674: Weak Password Requirements

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. /admin/access accepts a request to set the "aaaaa" password, considered insecure for some use cases, from a user...

Juniper Junos MX Malformed Packet - DOS (JSA10900)

Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon bbe-smgd, and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result...

CVE-2019-0001

Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon bbe-smgd, and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result...