Caldera 9.20 contains multiple vulnerabilities

Overview Caldera 9.20, and possibly earlier versions, contains multiple vulnerabilities. Description CWE-22 - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' - CVE-2014-2933Caldera 9.20 and possibly earlier versions contains a path traversal vulnerability due to the...

cups-filters cups-browsed OS命令注入漏洞

CVE ID:CVE-2014-2707 CUPS是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数PostScript和raster打印机服务。 cups-filters cups-browsed没有正确过滤打印机名和PDL的输入，允许攻击者利用漏洞提交恶意请求注入和执行任意shell命令。 0 cups-filters 1.x cups-filters 1.0.51版本已修复该漏洞，建议用户下载使用：...

Fritz!Box Webcm Unauthenticated Command Injection

Different Fritz!Box devices are vulnerable to an unauthenticated OS command injection. This module was tested on a Fritz!Box 7270 from the LAN side. The vendor reported the following devices vulnerable: 7570, 7490, 7390, 7360, 7340, 7330, 7272, 7270, 7170 Annex A A/CH, 7170 Annex B English, 7170...

Fritz!Box Webcm Unauthenticated Command Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Fritz!Box Webcm Unauthenticated Command Injection', 'Description' = %q Different Fritz!Box devices are vulnerable to an unauthenticat...

Linksys E-Series TheMoon Remote Command Injection Exploit

Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command injection. This vulnerability was used from the so called "TheMoon" worm. There are many Linksys systems that might be vulnerable including E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, E900. Th...

Linksys E-Series TheMoon Remote Command Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Linksys E-Series TheMoon Remote Command Injection', 'Description' = %q Some Linksys E-Series Routers are vulnerable to an...

IBM Tealeaf CX 8.8 - Remote OS Command Injection Vulnerability

Exploit for php platform in category web applications IBM Tealeaf CX v8 release 8 Remote OS Command Injection Date: 11/08/2013 Exploit author: drone More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/ Version:...

IBM Tealeaf CX 8.8 - Remote OS Command Injection

IBM Tealeaf CX 8.8 - Remote OS Command Injection IBM Tealeaf CX v8 release 8 Remote OS Command Injection Date: 11/08/2013 Exploit author: drone More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/ Version: Versio...

Allied Telesis AT-RG634A ADSL Broadband Router - Web Shell

Allied Telesis AT-RG634A ADSL Broadband Router - Web Shell Title: Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. Vulnerability Information: - CVE: CVE-2014-1982 - Type of Vulnerability: - CWE-78 : OS Command Injection - CWE-306 : Missing...

IBM Tealeaf CX 8.8 - Remote OS Command Injection

IBM Tealeaf CX v8 release 8 Remote OS Command Injection Date: 11/08/2013 Exploit author: drone More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/ Version: Version 8 Release 8 likely all versions prior Tested on...

VICIdial Manager Send OS Command Injection (CVE-2013-4468)

An OS Command Injection vulnerability has been reported in VICIdial Manager. The vulnerability is due to a web application uses unsanitized user input. A remote attacker could trigger this flaw by using a crafted SQL parameter value...

Webuzo 2.1.3 - Multiple Vulnerabilities

Webuzo 2.1.3 - Multiple Vulnerabilities Exploit Title: Webuzo Multiple Vulnerabilities Date: 7 October 2013 Exploit Author: Mahendra Vendor Homepage: www.webuzo.com Software Link: http://downloads.webuzo.com/va.php Version: 2.1.3, other version might be vulnerable. Tested on: CentOS release 6.2...

Webuzo 2.1.3 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Webuzo Multiple Vulnerabilities Date: 7 October 2013 Exploit Author: Mahendra Vendor Homepage: www.webuzo.com Software Link: http://downloads.webuzo.com/va.php Version: 2.1.3, other version might be vulnerable. Tested on: CentOS...

Webuzo 2.1.3 - Multiple Vulnerabilities

Exploit Title: Webuzo Multiple Vulnerabilities Date: 7 October 2013 Exploit Author: Mahendra Vendor Homepage: www.webuzo.com Software Link: http://downloads.webuzo.com/va.php Version: 2.1.3, other version might be vulnerable. Tested on: CentOS release 6.2 FINAL CVE : CVE-2013-6041, CVE-2013-6042,...

Linksys E-Series TheMoon Remote Command Injection

Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command injection. This vulnerability was used from the so-called "TheMoon" worm. There are many Linksys systems that are potentially vulnerable, including E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000,...

Security Advisory: NETGEAR Router D6300B Firmware: V1.0.0.14_1.0.14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory ID: SYSS-2013-001 Product: NETGEAR Router D6300B / Firmware: V1.0.0.141.0.14 latest Vendor: Netgear Affected Versions: until V1.0.0.141.0.14 latest Tested Versions: V1.0.0.141.0.14 latest Vulnerability Type: Root-Shell, OS Command Injection,...

Netgear D6300B Command Injection / Misconfiguration

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory ID: SYSS-2013-001 Product: NETGEAR Router D6300B / Firmware: V1.0.0.141.0.14 latest Vendor: Netgear Affected Versions: until V1.0.0.141.0.14 latest Tested Versions: V1.0.0.141.0.14 latest Vulnerability Type: Root-Shell, OS Command Injection,...

SEC Consult SA-20140122-0 :: Critical vulnerabilities in T-Mobile HOME NET Router LTE (Huawei B593u-12)

SEC Consult Vulnerability Lab Security Advisory 20140122-0 ======================================================================= title: Multiple critical vulnerabilities product: T-Mobile HOME NET Router LTE / Huawei B593u-12 vulnerable version: V100R001C54SP063 T-Mobile Austria fixed version:...

Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities

Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities Title: Ditto Forensic FieldStation, multiple vulnerabilities Versions affected: = 2013Oct15a all Vendor: CRU Wiebetech Discovered by: Martin Wundram Email: [email protected] Date found: 2013-04-22 Date published: 2013-12-12...

VICIdial Manager Send OS Command Injection Vulnerability

The file agc/managersend.php in the VICIdial web application uses unsanitized user input as part of a command that is executed using the PHP passthru function. A valid username, password and session are needed to access the injection point. Fortunately, VICIdial has two built-in accounts with...