1498 matches found
CVE-2019-19245
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginFormusername field when double quotes are used...
PT-2019-15790 · Napc Xinet · Napc Xinet Elegant 6 Asset Library
Name of the Vulnerable Software and Affected Versions: NAPC Xinet Elegant 6 Asset Library version 6.1.655 Description: The issue allows for Pre-Authentication SQL Injection via the "/elegant6/login" API endpoint, specifically through the username field in the LoginForm when double quotes are used...
Xinet Elegant 6 Asset Library Web Interface 6.1.655 SQL Injection
Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAPC-XINET-ELEGANT-6-ASSET-LIBRARY-WEB-INTERFACE-PRE-AUTH-SQL-INJECTION.txt + ISR: ApparitionSec Vendor www.napc.com Product Xinet Elegant 6 Asset Library Web Interface v6.1.655 Web based...
DEBIAN-CVE-2019-16905
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing...
CVE-2019-17186
/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...
CVE-2019-17186
/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...
Remote code execution
/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...
CVE-2019-17186
/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication remote code execution...
CVE-2019-17187
/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication Directory Traversal for reading arbitrary files...
CVE-2019-17187
/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication Directory Traversal for reading arbitrary files...
CVE-2019-17187
/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007JS201804 devices allows pre-authentication Directory Traversal for reading arbitrary files...
CVE-2019-13343
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...
Path traversal
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...
CVE-2019-13343
CVE-2019-13343 affects Butor Portal prior to 1.0.27 via a path traversal vulnerability in WhiteLabelingServlet. The t parameter is not properly sanitized, allowing a pre-authentication arbitrary file download by constructing a path like /wl?t=../../...&h=. Impact is potential exposure of server f...
CVE-2019-13343
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...
Exploit for Server-Side Request Forgery in Atlassian Jira_Server
Jira CVE-2019-8451 POC Description Proof of concept scan...
Cisco IOS XE ISDN Data Leakage Vulnerability
Cisco IOS XE is a set of operating systems developed by Cisco for its network devices. A data leakage vulnerability exists in the Dialer interface feature for ISDN connections in Cisco IOS XE for Cisco 4000 Series Integrated Services Routers. The vulnerability stems from insufficient validation o...
CVE-2019-12664
A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The...
Ubiquiti airOS Arbitrary File Upload
This module exploits a pre-auth file upload to install a new root user to /etc/passwd and an SSH key to /etc/dropbear/authorizedkeys. FYI, /etc/passwd,dropbear/authorizedkeys will be overwritten. /etc/persistent/rc.poststart will be overwritten if PERSISTETC is true. This method is used by the "m...