Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection

Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same L...

ASUS DSL-N12E_C1 1.1.2.3_345 Remote Command Execution

Exploit Title: ASUS DSL-N12EC1 1.1.2.3345 - Remote Command Execution Date: 2018-08-02 Exploit Author: Fakhri Zulkifli @d0lph1n98 Vendor Homepage: https://www.asus.com/ Software Link: https://www.asus.com/Networking/DSLN12EC1/HelpDeskBIOS/ Version: 1.1.2.3345 Tested on: 1.1.2.3345 GET...

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML...

ASUS DSL-N12E_C1 1.1.2.3_345 - Remote Command Execution

Exploit Title: ASUS DSL-N12EC1 1.1.2.3345 - Remote Command Execution Date: 2018-08-02 Exploit Author: Fakhri Zulkifli @d0lph1n98 Vendor Homepage: https://www.asus.com/ Software Link: https://www.asus.com/Networking/DSLN12EC1/HelpDeskBIOS/ Version: 1.1.2.3345 Tested on: 1.1.2.3345 GET...

Samsung SmartThings Hub Command Injection Vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung South Korea. A command injection vulnerability exists in the RTSP configuration of the smart camera in the Samsung SmartThings Hub, which stems from the program's failure to properly handle spaces in the URL field. An attacker...

Universal Media Server 7.1.0 XML Injection

Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same L...

PYSEC-2018-38

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as...

LG NAS 3718.510.a0 - Remote Command Execution

LG NAS 3718.510.a0 - Remote Command Execution LG NAS 3718.510.a0 - Remote Command Execution Author: @0x616163 Date: 2018-07-29 Credits: https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/ CVE: N/A Firmware Version: 3718.510.a0 !/usr/bin/env python import sys impor...

Vtiger CRM 6.3.0 Authenticated Logo Upload Remote Command Execution Exploit

Vtiger version 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This Metasploit module was tested against vTiger CRM versi...

LG NAS 3718.510.a0 - Remote Command Execution

LG NAS 3718.510.a0 - Remote Command Execution Author: @0x616163 Date: 2018-07-29 Credits: https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/ CVE: N/A Firmware Version: 3718.510.a0 !/usr/bin/env python import sys import argparse import requests from collections...

Command Execution Vulnerability in Lenovo M7650DNF Printer

The Lenovo M7650DNF is a black and white laser MFP targeted at individual users, SOHO offices and small and medium-sized businesses with copy/scan/fax needs. A command execution vulnerability exists in the Lenovo M7650DNF printer, which can be exploited by an attacker to remotely execute commands...

Vtiger CRM 6.3.0 Authenticated Logo Upload Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Vtiger CRM - Authenticated Logo Upload RCE', 'Description' = %q Vtiger 6.3.0 CRM's administration interface allows for the upload of a company...

Logic Vulnerability in OURPHP Building System V1.8.3

OURPHP a PHP + MySQL based on the development of W3C standards-compliant building system. A logic vulnerability exists in version V1.8.3 of the OURPHP website builder, which can be exploited by attackers to execute remote commands...

CVE-2018-11491

ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution...

CVE-2018-11491

ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution...

CVE-2018-11491

ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution...

CVE-2018-11491

Consolidated evidence identifies a CVE for ASUS HG100 devices. Affected: ASUS HG100 home smart monitoring device running firmware versions prior to 1.05.12. Issue: command execution via unauthenticated access, enabling remote code execution. Root cause details are stated in CNVD-2018-17185 as a v...

Path traversal

The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle...

CVE-2017-3189

The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle...

CVE-2017-3189 The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload

The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle...