Exploit for OS Command Injection in Webmin

Webmin 1.890 expired Remote Root CVE-2019-15107 Webmin ve...

PT-2021-6507 · Saltstack +2 · Saltstack Salt +2

Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 3003.3 Description: The issue is related to information disclosure in the error data area of the Salt configuration management and remote execution system. Exploitation of this issue allows a remote attacker t...

Cisco Vision Dynamic Signage Director Web Management Interface Path Traversal Vulnerability

Cisco Vision Dynamic Signage Director is an end-to-end dynamic signage and IPTV solution from Cisco USA. A path traversal vulnerability exists in the Web management interface in Cisco Vision Dynamic Signage Director versions prior to 6.2 SP5, which stems from the interface failing to properly...

etcd Input Validation Error Vulnerability

etcd is a key-value storage system for distributed systems written in the Go language. An input validation error vulnerability exists in etcd versions prior to 3.3.23 and prior to 3.4.10. The vulnerability stems from a network system or product that does not properly validate input data. A remote...

Teltonika TRB245 Improper Input Validation Vulnerability

Teltonika TRB245 is a cellular network gateway product from Teltonika Lithuania. An improper input validation vulnerability exists in the firmware TRB2R00.02.04.01 of the Teltonika TRB245. A remote attacker can exploit this vulnerability to gain root privileges by uploading a malicious package fi...

Teltonika TRB245 Improper Input Validation Vulnerability (CNVD-2020-44605)

Teltonika TRB245 is a cellular network gateway product from Teltonika Lithuania. An improper input validation vulnerability exists in the firmware TRB2R00.02.04.01 of the Teltonika TRB245. A remote attacker can exploit this vulnerability to gain root privileges with the help of a malicious backup...

grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access...

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, Cisco Small Business RV130, Cisco Small Business RV130W, and Cisco Small Business RV215W allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the web-based management interface for Cisco Small Business RV110W, Cisco Small Business RV130, Cisco Small Business RV130W, and Cisco Small Business RV215W lies in the lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to execute...

Buffer Overflow Vulnerability in Multiple Cisco Products (CNVD-2020-35167)

Cisco RV110W and others are a VPN firewall router from Cisco USA. A buffer overflow vulnerability exists in the Web management interface of several Cisco products, which arises from the program's failure to properly restrict user input boundaries and can be exploited by a remote attacker with a...

SUSE SLES12 Security Update : krb5-appl (SUSE-SU-2020:1533-1)

This update for krb5-appl fixes the following issues : CVE-2020-10188: Fixed a remote root execution bsc1165787. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

SUSE-SU-2020:1533-1 Security update for krb5-appl

This update for krb5-appl fixes the following issues: - CVE-2020-10188: Fixed a remote root execution bsc1165787...

Authorization

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested...

CVE-2020-10794

Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. This can be combined with CVE-2020-10795 for remote root access...

CVE-2020-10795

Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CVE-2020-10794 for remote root access...

CVE-2020-10794

Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. This can be combined with CVE-2020-10795 for remote root access...

Path traversal

Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. This can be combined with CVE-2020-10795 for remote root access...

CVE-2020-10795

Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CVE-2020-10794 for remote root access...

CVE-2020-10794

Gira TKS-IP-Gateway 4.0.7.7 is affected by an unauthenticated path traversal vulnerability that lets an attacker download the application database. This CVE (CVE-2020-10794) is linked to CVE-2020-10795, which describes authenticated remote code execution via the backup web frontend and could enab...

CVE-2020-8797

Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call aka Command Line Injection, if the undocumented telnetd service is enabled and the attacker can authenticate as admin from the local network...

Multiple DrayTek Products - Pre-authentication Remote Root Code Execution

Multiple DrayTek Products - Pre-authentication Remote Root Code Execution package main / CVE-2020-8515: DrayTek pre-auth remote root RCE Mon Mar 30 2020 - 0xsha.io Affected: DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta You should upgrade as...