EMC VNX2 OE for File and VNX1 OE for File Local Elevation of Privilege Vulnerability

The EMC VNX2 OE for File and VNX1 OE for File are file storage devices from EMC Corporation USA. A security vulnerability exists in EMC VNX2 OE for File and VNX1 OE for File, which can be exploited by a local attacker to submit a special request to execute arbitrary commands with root privileges...

CVE-2017-8116

The management interface for the Teltonika RUT9XX routers aka LuCI with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request...

Remote Command Injection Vulnerability at Foscam camera Add User

FOSCAM Group is a national high-tech enterprise specializing in the design, research and development, manufacturing and sales of network cameras, network video recorders and other products. Remote command injection vulnerability exists in the usrName parameter of the CGIProxy.fcgi addAccount...

Cisco Prime Collaboration Provisioning Authentication Bypass Vulnerability

Cisco Prime Collaboration is a comprehensive video and voice service assurance and management system. An authentication bypass vulnerability exists in the web interface of Cisco Prime Collaboration Provisioning, which stems from a lack of security restrictions in certain HTTP request methods. An...

Design/Logic Flaw

In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root...

CVE-2017-8859

In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root...

CVE-2017-1122

IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be executed as root. IBM X-Force ID: 121174...

GPG Suite Arbitrary Command Execution Vulnerability

GPG Suite is an iOS-based encryption and decryption suite for communication security. A security vulnerability exists in the 'installPackage' function of the installerHelper subcomponent in versions of GPG Suite prior to 2015.06. A local attacker can exploit the vulnerability to execute arbitrary...

CVE-2016-10107

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header...

CVE-2016-10108

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

Authentication Command Injection Vulnerability in PwdGrp.cgi for AVTECH Devices

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. An authentication command injection vulnerability exists in AVTECH device PwdGrp.cgi. The PwdGrp.cgi script can be used to...

CVE-2016-6373

The web-based GUI in Cisco Cloud Services Platform CSP 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541...

CVE-2016-4965

Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosiscontrol.php...

Bihu's uRouter Wireless Router Has Multiple Vulnerabilities

Bihu uRouter Wireless Router is an enterprise-grade intelligent routing product manufactured and marketed by Bihu Technology in China. Multiple vulnerabilities exist in the Bihu uRouter. An unauthenticated attacker can bypass the system authentication mechanism by providing a random SID cookie...

Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution

i? Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution Vendor: Iris ID, Inc. Product web page: http://www.irisid.com http://www.irisid.com/productssolutions/hardwareproducts/icu-7000-2/ Affected version: ICU Software: 1.00.08 ICU OS: 1.3.8 ICU File system: 1.3.8 EIF Firmware Channel 1: 1....

F5 iControl - 'iCall::Script' Root Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'nokogiri' class Metasploit3 "http://schemas.xmlsoap.org/soap/encoding/" STRINGATTRS = 'xsi:type' = 'urn:Common.StringSequence',...

RSA Web Threat Detection Elevation of Privilege Vulnerability

RSA Web Threat Detection is a big data and security analytics solution. A security vulnerability exists in RSA Web Threat Detection that could be exploited by a local attacker to inject special commands into a configuration file to execute arbitrary system commands with ROOT privileges...

Red Hat OpenShift Enterprise Arbitrary Command Execution Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. A security vulnerability exists in Red Hat OpenShift Enterprise version 3.0.0.0 tha...

abrt: default abrt event scripts lead to information disclosure

It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. The fix for this issue prevents non-privileged use...

Watchguard XCS FixCorruptMail Local Privilege Escalation

This module exploits a vulnerability in the Watchguard XCS 'FixCorruptMail' script called by root's crontab which can be exploited to run a command as root within 3 minutes. Module Options msf use exploit/freebsd/local/watchguard/fixcorruptmail msf undefinedfixcorruptmail show actions ...actions...