EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2020-1227)

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The addjob function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attacke...

Unspecified Vulnerability in Multiple Mozilla Products (CNVD-2020-18416)

Mozilla Firefox and others are products of the Mozilla Foundation in the U.S.A. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser.Mozilla Thunderbird is a suite of e-mail client software separate from the Mozilla Application...

Pandora FMS Ping Authenticated Remote Code Execution

This module exploits a vulnerability found in Pandora FMS 7.0NG and lower. nettools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands. Module Options msf use exploit/linux/http/pandora/pingcmdexec msf undefinedpingcmdexec show actions ...actions... msf...

IBM Spectrum Protect Plus username Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of IBM Spectrum Protect Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Administrative Console Framework service. When parsing the username...

Security Bulletin: A security vulnerability has been addressed in IBM Security Privileged Identity Manager

Summary IBM Security Privileged Identity Manager has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication attempts. B...

Endless Group: Enumeration of username on password reset page

Summary: Reset password page api call, can be used to enumerate usernames based on the error message Steps To Reproduce: add details for how we can reproduce the issue 1. Go to password reset page 2. Enter username and click submit 3. Check email for password reset code, open the url in any brows...

CVE-2019-5153

An exploitable remote code execution vulnerability exists in the iwwebs configuration parsing functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An attacker can send...

EulerOS 2.0 SP8 : openssh (EulerOS-SA-2020-1170)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target...

SecuSTATION IPCAM-130 HD Camera - Remote Configuration Disclosure

Exploit Title: SecuSTATION IPCAM-130 HD Camera - Remote Configuration Disclosure Author: Todor Donev Date: 2020-02-23 Vendor: https://secu.jp/ Product Link: https://secu.jp/support/831nh1.html CVE: N/A SecuSTATION IPCAM-130 HD Camera Remote Configuration Disclosure Copyright 2020 c Todor Donev...

ACE SECURITY WiP-90113 HD Camera Remote Configuration Disclosure

!/usr/bin/perl ACE SECURITY WiP-90113 HD Camera Remote Configuration Disclosure Copyright 2020 c Todor Donev https://donev.eu/ Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that Todor Don...

SecuSTATION SC-831 HD Camera - Remote Configuration Disclosure Exploit

Exploit for hardware platform in category web applications Exploit Title: SecuSTATION SC-831 HD Camera - Remote Configuration Disclosure Author: Todor Donev Date: 2020-02-23 Vendor: https://secu.jp/ Product Link: https://secu.jp/support/831.html CVE: N/A !/usr/bin/perl SecuSTATION SC-831 HD Camer...

CVE-2020-6841

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

Amovision AM-Q6320-WIFI HD Camera Remote Configuration Disclosure

!/usr/bin/perl Amovision AM-Q6320-WIFI HD Camera Remote Configuration Disclosure Copyright 2020 c Todor Donev https://donev.eu/ Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that Todor...

PT-2020-6868 · D Link · D-Link Dch-M225

Name of the Vulnerable Software and Affected Versions: D-Link DCH-M225 versions 1.05b01 and earlier Description: The issue is related to the spotifyConnect.php script in the D-Link DCH-M225 device, where it fails to neutralize special elements used in an OS command when processing the userName...

DBPower C300 HD Camera - Remote Configuration Disclosure Exploit

Exploit for hardware platform in category web applications Exploit Title: DBPower C300 HD Camera - Remote Configuration Disclosure Author: Todor Donev Vendor: https://donev.eu/ CVE: N/A Copyright 2020 c Todor Donev https://donev.eu/ https://donev.eu/blog/dbpower-c300-multiple-vulnerabilities...

DBPower C300 HD Camera - Remote Configuration Disclosure

DBPower C300 HD Camera - Remote Configuration Disclosure Exploit Title: DBPower C300 HD Camera - Remote Configuration Disclosure Date: 2020-02-19 Author: Todor Donev Vendor: https://donev.eu/ CVE: N/A Copyright 2020 c Todor Donev https://donev.eu/...

CVE-2020-8891

An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests...

Code injection

An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...