PT-2014-2922

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ Internet Pass-Thru MQIPT versions 2.0 through 2.1.0.0 Description The issue affects the command-port listener, allowing remote attackers to cause a denial of service, which results in a remote-administration outage. The exact...

Microsoft Remote Administration Protocol Server Name Buffer Overflow - Ver2 (CVE-2012-1853)

A buffer overflow vulnerability has been reported in the Remote Administration Protocol RAP implementation in the LanmanWorkstation service in Microsoft Windows XP SP3. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Linksys Routers Vulnerable to Remote Access Vulnerability

Linksys routers sold to consumers as a home or small office networking box are vulnerable to a simple exploit that could give an attacker remote access to the router. The vulnerabilities are wormable, yet are unrelated to the Moon worm reported last week by the SANS Institute. Linksys, which was...

Moon Worm Spreading on Linksys Home and SMB Routers

A self-replicating worm is spreading among a number of different Linksys home and small business routers. Researchers at the SANS Institute reported the outbreak yesterday and have not been able to determine whether there is a malicious payload or if the worm connects to a command and control...

Your MacBook Camera could Spy on You without lighting up the warning light

If you own Apple's MacBook, you should cover up it's webcam, because there's a possibility someone could be watching you. Like most webcams, the MacBook also has a tiny green light lets you know that the webcam is active, but it's possible for malware to disable this important privacy feature on...

D-Link Patches Backdoor Vulnerabilities in Routers

D-Link has patched a backdoor present in a number of its routers that was publicized almost two months ago and could allow an attacker to remotely access the administrative panel on the hardware, run code and make any number of changes. The Thanksgiving patch parade addressed the issue in a numbe...

UBUNTU-CVE-2013-3630

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

Netgear Routers Open to Remote Authentication Bypass, Command Injection

There is a vulnerability in some Netgear wireless routers that allows a remote attacker to completely compromise a device and gain root privileges. The bug is trivially exploitable and the researcher who discovered it has posted a proof-of-concept exploit. The vulnerability is a command-injection...

Watchguard Extensible Threat Management (XTM) appliance version 11.7.4 contains a buffer overflow vulnerability

Overview Watchguard Extensible Threat Management XTM version 11.7.4 and possibly earlier versions contain a buffer overflow vulnerability CWE-121. Description CWE-121: Stack-based Buffer Overflow Watchguard Extensible Threat Management XTM version 11.7.4 and possibly earlier versions contain a...

CVE-2013-5692

Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the file parameter to index.php/admin/translationManager...

Juniper NSM GUI Server Detection

The remote host is running the Juniper NSM GUI Server. The NSM GUI accepts connections from users using the NSM GUI Client, which allows for administration of the NSM servers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69870; scriptversion"1.9";...

Poison Ivy Detection

The remote host is running a Poison Ivy client. Poison Ivy is a Remote Administration Tool RAT used to control computers infected by malware. The 'client' is the component used to control those computers. It is associated with malicious activity. %NASLMINLEVEL 70300 C Tenable Network Security, In...

CVE-2013-3578

SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server ERAS allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter aka the search field, leading to execution of operating-system...

CVE-2013-3577

Affected product/area: Wave EMBASSY Remote Administration Server (ERAS) – Help Desk application. Vulnerability: CVE-2013-3577 is a SQL injection flaw that allows a remote attacker to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue (the search field). Root cause: In...

CVE-2013-3577

SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server ERAS allows remote attackers to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter aka the search field...

PT-2013-4490

Name of the Vulnerable Software and Affected Versions Wave EMBASSY Remote Administration Server ERAS affected versions not specified Description The issue allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter, which is the...

CVE-2013-3578: Improper Neutralization of Special Elements used in an OS Command

SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server ERAS allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter aka the search field, leading to execution of operating-system...

PT-2013-4489

Name of the Vulnerable Software and Affected Versions Wave EMBASSY Remote Administration Server ERAS affected versions not specified Description A SQL injection issue in the Help Desk application of Wave EMBASSY Remote Administration Server ERAS allows remote attackers to execute arbitrary SQL...

CVE-2013-3577: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server ERAS allows remote attackers to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter aka the search field...

Wave EMBASSY Remote Administration Server SQL injection vulnerabilities

Overview The Wave EMBASSY Remote Administration Server ERAS contains the ERAS Help Desk application that fails to filter user input allowing for the exploitation of SQL injection vulnerabilities. These vulnerabilities may allow a remote authenticated attacker to execute procedures or SQL queries...