Command injection

Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update...

CVE-2016-9316

Multiple stored Cross-Site-Scripting XSS vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary...

CVE-2016-9315

Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or ad...

Trend Micro InterScan Web Security Virtual Appliance Elevation of Privilege Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. An elevation of privilege vulnerability exists in Trend Micro IWSVA version 6.5. An attack...

Trendmicro InterScan 6.5-SP2_Build_Linux_1548 Remote Root

KL-001-2017-003 : Trendmicro InterScan Remote Root Access Vulnerability Title: Trendmicro InterScan Remote Root Access Vulnerability Advisory ID: KL-001-2017-003 Publication Date: 2017.02.15 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-003.txt 1. Vulnerability Detai...

Trend Micro InterScan Web Security Virtual Appliance 6.5 Multiple Vulnerabilities

Trend Micro has released a new build of Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5. This build resolves vulnerabilities in the product that could potentially allow a remote attacker to execute artibtrary code on vulnerable installations. SPDX-FileCopyrightText: 2017 Greenbone ...

Design/Logic Flaw

Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0.13, 5.0.x before 5.0.17 and Splunk Light versions before 6.5.2 allows remote authenticated users to cause a denial of service daemon cras...

Citrix XenServer Multiple Security Updates (CTX212736)

A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM depending on configuration or an attacker on the management network to compromise the host. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might b...

Novell ServiceDesk Authenticated File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Novell ServiceDesk Authenticated File Upload', 'Description' = %q This module exploits an authenticated arbitrary file upload v...

Novell ServiceDesk Authenticated File Upload

This module exploits an authenticated arbitrary file upload via directory traversal to execute code on the target. It has been tested on versions 6.5 and 7.1.0, in Windows and Linux installations of Novell ServiceDesk, as well as the Virtual Appliance provided by Novell. Module Options msf use...

Kaseya's agent driver contains NULL pointer dereference

Overview Kaseya's agent driver, kapfa.sys, is vulnerable to a NULL pointer dereference. Description CWE-476: NULL Pointer Dereference Kaseya's agent driver, kapfa.sys, is vulnerable to a NULL pointer dereference. --- Impact A local authenticated attacker may be able to cause a denial-of-service...

QNX 6.4.x/6.5.x ifwatchd - Local root Exploit

No description provided by source. !/bin/sh QNX 6.4.x/6.5.x ifwatchd local root exploit by cenobyte 2013 [email protected] - vulnerability description: Setuid root ifwatchd watches for addresses added to or deleted from network interfaces and calls up/down scripts for them. Any user can...

JVN#52492830: VxWorks SSH server (IPSSH) denial-of-service (DoS) vulnerability

The SSH server IPSSH implementation in VxWorks contains a denial-of-service vulnerability due to an issue in processing pty requests. Impact Receiving a specially crafted pty request packet may cause SSH access to be unavailable until the next reboot. Solution Apply a patch Apply the appropriate...

Upgrade to version 6.5 fails with the "Unable to connect to SQL Server" error

Challenge When upgrading to Veeam Backup & Replication version 6.5 you receive the error: "Unable to connect to SQL Server servername=:Login failed for user", even though the dbowner account is used. You also experience one of the following symptoms: You receive repeated logon windows You receive...

Debian Security Advisory DSA 2523-1 (globus-gridftp-server)

The remote host is missing an update to globus-gridftp-server announced via advisory DSA 2523-1. OpenVAS Vulnerability Test $Id: deb25231.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2523-1 globus-gridftp-server Authors: Thomas Reinke Copyright: Copyrigh...

iDefense Security Advisory 05.24.11: IBM Lotus Notes RTF Attachment Viewer Stack Buffer Overflow

iDefense Security Advisory 05.24.11 http://labs.idefense.com/intelligence/vulnerabilities/ May 24, 2011 I. BACKGROUND IBM Corp.'s Lotus Notes software is an integrated desktop client option for accessing e-mail, calendars and applications on an IBM Corp. Lotus Domino server. More information can ...

Null pointer dereference

IBM solidDB 4.5.x before 4.5.182, 6.0.x before 6.0.1069, 6.1.x and 6.3.x before 6.3 FP8 aka 6.3.49, and 6.5.x before 6.5 FP4 aka 6.5.0.4 does not properly handle the 1 rpctestsvcreadwrite and 2 rpctestsvcdone commands, which allows remote attackers to cause a denial of service NULL pointer...

Microsoft Windows Mobile - Overly Long vCard Name Field Denial of Service

source: https://www.securityfocus.com/bid/44287/info Microsoft Windows Mobile is prone to a denial-of-service vulnerability because it fails to adequately validate user-supplied input. An attacker can exploit this issue to crash a device running Windows Mobile, denying service to legitimate users...

Acunetix Ltd 2010 Version 6.5 Build 20100616 DLL Hijacking Exploit

Exploit for windows platform in category local exploits ================================================================== Acunetix Ltd 2010 Version 6.5 Build 20100616 DLL Hijacking Exploit ==================================================================...

Wyse ThinOS LPD service buffer overflow vulnerability

Overview Wyse ThinOS HF 4.4.079i has a buffer overflow vulnerability in the LPD service 515/tcp. Description The LPD service 515/tcp on Wyse ThinOS HF 4.4.079i crashes when a long buffer is sent to it. This condition may exist in all versions before Wyse ThinOS 6.5. --- Impact An attacker can cau...