CVE-2018-15906

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

CVE-2018-15906

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

Cross site scripting

SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting XSS in the Web management interface via URL path and HTTP POST parameter...

PT-2019-10732 · Denx Software Engineering · Das U-Boot

Name of the Vulnerable Software and Affected Versions: Das U-Boot versions 2013.07-rc1 through 2014.07-rc2 Description: A security issue exists in the verified boot protection of Das U-Boot, where the affected versions lack proper FIT signature enforcement. This allows an attacker to bypass the...

Das U-Boot verified boot bypass

Summary An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot’s verified boot and execute an unsigned kernel, embedded in...

CVE-2018-15906

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file...

CVE-2018-15906

CVE-2018-15906 affects SolarWinds Serv-U FTP Server 15.1.6. A remote authenticated user can exploit the Import feature by modifying a CSV, enabling privilege escalation to SYSTEM and remote code execution on default Windows installations. Documented impact includes escalation from Domain Administ...

CVE-2018-19934

The vulnerability CVE-2018-19934 affects SolarWinds Serv-U FTP Server 15.1.6.25. It is a reflected cross-site scripting (XSS) flaw in the Web management interface, exploit happening via the URL path and HTTP POST parameters. The issue is documented across multiple sources (NVD, Red Hat advisory) ...

CVE-2019-7384

CVE-2019-7384 affects Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON ONTs with firmware

Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 - Remote Code Execution

Raisecom XPON ISCOMHT803G-U2.0.0140521R4.1.47.002 - Remote Code Execution Exploit Title: Remote code execution in Raisecom xpon Date: 03/03/2019 Exploit Author: JameelNabbo Website: Ordina.nl Vendor Homepage: https://www.raisecom.com Software Link: https://www.raisecom.com/products/xpon Version:...

Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 - Remote Code Execution

Exploit Title: Remote code execution in Raisecom xpon Date: 03/03/2019 Exploit Author: JameelNabbo Website: Ordina.nl Vendor Homepage: https://www.raisecom.com Software Link: https://www.raisecom.com/products/xpon Version: ISCOMHT803G-U2.0.0140521R4.1.47.002 Tested on: MacOSX CVE-2019-7385 POC:...

Raisecom Technology GPON-ONU HT803G-07 Command Injection

===================================== Authenticated Shell Command Injection ===================================== . contents:: Table Of Content Overview ======== Title:- Authenticated Shell command Injection Author: Kaustubh G. Padwad CVE ID: CVE-2019-7384. Vendor: Raisecom technology co.,LTD...

SolarWinds Serv-U FTP 15.1.6 Privilege Escalation

CVE: CVE-2018-15906 Attack type: Remote, authenticated Discovered by: Chris Moberly @ The Missing Link Security Operating Systems: Verified on Win10 and Win2016 Vulnerable version: Tested on 15.1.6 current as of August 2018. Fixed in: Serv-U 15.1.6 Hotfix 2 Description SolarWinds Serv-U FTP Serve...

SolarWinds Serv-U FTP 15.1.6.25 Cross Site Scripting Vulnerability

Exploit for windows platform in category web applications Issue: Reflected Cross-Site Scripting CVE: CVE-2018-19934 Security researcher: Chris Moberly @ The Missing Link Security Product name: Serv-U FTP Server Product version: Tested on 15.1.6.25 current as of Dec 2018 Fixed in: Serv-U 15.1.6...

SolarWinds Serv-U FTP 15.1.6.25 Cross Site Scripting

Issue: Reflected Cross-Site Scripting CVE: CVE-2018-19934 Security researcher: Chris Moberly @ The Missing Link Security Product name: Serv-U FTP Server Product version: Tested on 15.1.6.25 current as of Dec 2018 Fixed in: Serv-U 15.1.6 hotfix 3 Overview The Serv-U FTP Server is vulnerable to a...

SolarWinds Serv-U FTP 15.1.6 Privilege Escalation Vulnerability

SolarWinds Serv-U FTP Server version 15.1.6 is vulnerable to privilege escalation from remote authenticated users by leveraging the CSV user import function. This leads to obtaining remote code execution under the context of the Windows SYSTEM account in a default installation. CVE: CVE-2018-1590...

DuckDuckGo: XXE on https://duckduckgo.com

An XML External Entity XXE injection vulnerability was discovered in the x.js endpoint on https://duckduckgo.com via u parameter. This was due to improper sanitation of external XML entities. The results was a leak of certain world readable files on the system. This issue was patched. Additionall...

Serv-U FTP Server 15.1.7 - Local Privilege Escalation (2)

Serv-U FTP Server 15.1.7 - Local Privilege Escalation 2 !/bin/bash SUroot - Local root exploit for Serv-U FTP Server versions prior to 15.1.7 CVE-2019-12181 Bash variant of Guy Levin's Serv-U FTP Server exploit: - https://github.com/guywhataguy/CVE-2019-12181 ---...

Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (2)

!/bin/bash SUroot - Local root exploit for Serv-U FTP Server versions prior to 15.1.7 CVE-2019-12181 Bash variant of Guy Levin's Serv-U FTP Server exploit: - https://github.com/guywhataguy/CVE-2019-12181 --- user@debian-9-6-0-x64-xfce:/Desktop$ ./SUroot Launching Serv-U ... sh: 1: : Permission...

GLSA-201812-09 : Go: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201812-09 Go: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Go. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could cause arbitrary code execution by passing...