Command execution vulnerability at root level in Xiaomi Router 3A user management page

Xiaomi Router 3A is a router. A command execution vulnerability exists at the root level of the Xiaomi Router 3A user management page. An attacker can exploit the vulnerability to remotely execute arbitrary code...

Cisco Data Center Network Manager Privilege Escalation to Underlying Operating System Vulnerability

A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP...

CVE-2018-5553

The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access...

CVE-2018-5553

The connected advisories confirm CVE-2018-5553 affects Crestron Console services on DGE-100, DM-DGE-200-C, and TS-1542-C devices. The flaw enables remote command injection via the PING command due to improper input validation, allowing code execution with root privileges. Exploitation requires no...

CVE-2018-5553: Improper Neutralization of Special Elements used in an OS Command

The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access...

Security Bulletin: DB2 local escalation of privilege vulnerability affects IBM Tivoli Storage Manager Server (CVE-2015-1947)

Summary IBM Tivoli Storage Manager IBM Spectrum Protect Server is affected by an IBM DB2 software vulnerability that can result in a local user gaining root level access to which the user is not entitled. Vulnerability Details CVEID: CVE-2015-1947 DESCRIPTION: IBM DB2 software is vulnerable to a...

CVE-2018-0352

A vulnerability in the Disk Check Tool disk-check.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to log in to the...

Input validation

A vulnerability in the Disk Check Tool disk-check.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to log in to the...

CVE-2018-0352

A vulnerability in the Disk Check Tool disk-check.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to log in to the...

CVE-2018-0352

A vulnerability in the Disk Check Tool disk-check.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to log in to the...

Command injection

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

CVE-2017-14459: Improper Neutralization of Special Elements used in an OS Command

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

Design/Logic Flaw

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

CVE-2018-1182

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

CVE-2018-1182

CVE-2018-1182 affects EMC RSA Identity Governance and Lifecycle (versions 7.0.1 and 7.0.2), RSA Via Lifecycle and Governance (version 7.0), and RSA Identity Management & Governance (RSA IMG) (versions 6.9.0 and 6.9.1). The issue allows certain OS-level users to execute arbitrary scripts with root...

CVE-2017-1692: Undefined Security Weakness

IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM X-Force ID: 134067...

Privilege escalation

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

CVE-2017-4943

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

CVE-2017-4943: Out-of-bounds Write

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

HackerOne: Introspection query leaks sensitive graphql system information.

Summary: Interospection query leaks sensitive data. Introduction As we know graphql was initially developed and used by facebook as an internal query language and so the features of graphql mostly revolve around internal and development areas. Graphql executes queries using a type system with the...