CVE-2014-0120

CVE-2014-0120 is a CSRF vulnerability in Hawt.io’s admin terminal that enables a remote attacker to hijack the user’s authenticated session and issue commands on the Karaf server (examples include shutdown -f). Multiple connected sources describe Hawt.io admin terminal CSRF and the potential to e...

CVE-2014-0120

Cross-site request forgery CSRF vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."...

CVE-2014-0121

The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter...

[SECURITY] Fedora 27 Update: shellinabox-2.20-5.fc27

Shell In A Box implements a web server that can export arbitrary command li ne tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser and does not require any additional browser plugins...

[SECURITY] Fedora 26 Update: shellinabox-2.20-5.fc26

Shell In A Box implements a web server that can export arbitrary command li ne tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser and does not require any additional browser plugins...

Privilege Escalation

github.com/juju/juju is vulnerable to privilege escalation. A malicious user with access to the terminal can gain root privileges through the command juju-run 'whoami'...

Huawei DP300 CIDAM Protocol Input Checksum Vulnerability (CNVD-2017-38106)

Huawei DP300 is a video conferencing terminal from Huawei, China.CIDAM is one of the messaging protocols. An input validation vulnerability exists in the CIDAM protocol in the Huawei DP300 due to the program failing to adequately validate specific information. A remote attacker could exploit this...

Huawei DP300 CIDAM Protocol Input Validation Vulnerability (CNVD-2017-38104)

Huawei DP300 is a video conferencing terminal from Huawei, China.CIDAM is one of the messaging protocols. An input validation vulnerability exists in the CIDAM protocol in the Huawei DP300 due to the program failing to adequately validate specific information. A remote attacker could exploit this...

TP-Link TL-SG108E XSS / Weak Access Control

Overview ------------- Three vulnerabilities have been discovered in the TP-Link TL-SG108E, firmware 1.0.0 Build 20160722 Rel.50167: CVE-2017-17745 - Cross Site Scripting XSS in systemnameset.cgi, sysName parameter CVE-2017-17746 - Weak access control for user authentication CVE-2017-17747 - Weak...

Moderate: Red Hat Security Advisory: rh-ruby24-ruby security, bug fix, and enhancement update

An update for rh-ruby24-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Reddit Terminal Viewer (RTV) Parameter Injection Vulnerability

Reddit Terminal Viewer RTV is a simple terminal viewer for Reddit. A parameter injection vulnerability exists in Reddit Terminal Viewer RTV 1.19.0. The vulnerability arises because scripts/inspectwebbrowser.py in RTV does not validate strings before launching a program specified by the BROWSER...

Authentication fails using SSH keys since 2.3.5

Neither the Pagent agent or OpenSSH is working to authenticate since I upgraded. Switching SSH services makes no difference. If I go to the command line, using ssh -i identfile I have no issues authenticating to any system. Other symptoms include the terminal not going to the repository but using...

DEBIAN-CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

Design/Logic Flaw

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

UBUNTU-CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-10906

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors...

Fluentd vulenrable to escape sequence injection

Overview Fluentd provided by Cloud Native Computing Foundation CNCF contains an escape sequence injection vulnerability. Fluentd is an open source data collector provided by Cloud Native Computing Foundation CNCF. The parse Filter Plugin for Fluentd contains an escape sequence injection...