烽火（Fiberhome）HG-110 设备目录穿越漏洞

知道创宇安全研究团队 2015 . 03 . 31一.漏洞概要近期，国外安全研究员发布了针对全球 ADSL 设备存在目录穿越漏洞的研究网页链接1，这个漏洞早在 2011 年就被提出了，影响烽火（Fiberhome）HG-110 型号设备网页链接2，本着学习的态度，笔者对该漏洞进行了一番考证，写在这里。a）漏洞描述烽火（Fiberhome）HG-110 型号设备目录穿越漏洞网页链接3，是由于 webproc 文件在处理参数 getpage 传递过来的文件访问时没有合适过滤，导致用户可以利用 ../../ 跳转访问 web 目录之外的系统文件。b）漏洞分析烽火（Fiberhome）HG-11...

Spectris N-Tron 702-W Industrial Wireless Access Point Device Key Vulnerability

The Spectris N-Tron 702-W Industrial Wireless Access Point device is a wireless access point device. The Spectris N-Tron 702-W Industrial Wireless Access Point device has a security vulnerability due to the use of the same SSH and HTTPS private keys during installation by different users. Allowin...

CVE-2012-4716

N-Tron 702-W Industrial Wireless Access Point devices use the same 1 SSH and 2 HTTPS private keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key...

Hardcoded credentials

N-Tron 702-W Industrial Wireless Access Point devices use the same 1 SSH and 2 HTTPS private keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key...

CVE-2012-4716

CVE-2012-4716 affects N-Tron 702-W Industrial Wireless Access Point devices. The root cause is hard-coded SSH and HTTPS private keys that are identical across different installations, enabling an attacker to decrypt traffic and compromise confidentiality/integrity of communications. The vulnerabi...

CVE-2012-4716

N-Tron 702-W Industrial Wireless Access Point devices use the same 1 SSH and 2 HTTPS private keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key...

WordPress XCloner 3.1.2 XSS / Command Execution

Title: Xloner v3.1.2 wordpress plugin authenticated command execution and XSS Author: Larry W. Cashdollar, @larry0 Date: 2015-05-10 Download Site: https://wordpress.org/plugins/xclonerbackupandrestore/ http://extensions.joomla.org/extensions/accessasecurity/ sitesecurity/ backup/665 Vendor: Ovidi...

Beacon（Fiberhome）HG-1 1 0 device directory traversal vulnerability study-vulnerability warning-the black bar safety net

Know Chong Yu security research group 2 0 1 5 . 0 3 . 3 1 This article PDF Download: fiberhome HG-1 1 0 device recorded traversal vulnerability study 1. Updates Edition: first edition Time: 2015 / 3 / 31 Description: The first edition of the complete 2. Vulnerability summary Recently, foreign...

CVE-2014-6939

The Sketch W Friends FREE -Tablets aka air.com.xlabz.SketchWFriendsFree application 5.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Sketch W Friends FREE -Tablets aka air.com.xlabz.SketchWFriendsFree application 5.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6939

The CVE-2014-6939 entry concerns the Android app Sketch W Friends FREE -Tablets (package air.com.xlabz.SketchWFriendsFree), version 5.0.0. The vulnerability is that the application does not verify X.509 certificates from SSL servers, which enables man-in-the-middle attackers to spoof servers and ...

CVE-2014-6939

The Sketch W Friends FREE -Tablets aka air.com.xlabz.SketchWFriendsFree application 5.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

USN-2317-1: Linux kernel (Trusty HWE) vulnerabilities

Eric W. Biederman discovered a flaw with the mediation of mount flags in the Linux kernel's user namespace subsystem. An unprivileged user could exploit this flaw to by-pass mount restrictions, and potentially gain administrative privileges. CVE-2014-5207 Kenton Varda discovered a flaw with...

Oracle Linux 6 / 7 : unbreakable enterprise kernel (ELSA-2014-3067)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3067 advisory. - net: Use netlinknscapable to verify the permisions of netlink messages Eric W. Biederman Orabug: 19404231 CVE-2014-0181 Tenable has extracted the...

J&W Communications SQL Injection

Title: J&W Communications Cms SQL Injection Vulnerability + Date: 2014-07-29 + Author: Hekt0r + Vendor Homepage: www.jw-com.com + Tested on: Windows7 & Kali Linux + Vulnerable Files: /rosters.php /team.php /scoresheet.php + Dork : intext:"designed by J&W Communications" inurl:/team.php.php?id=...

Web Servers W-Agora Remote File Inclusion (CVE-2002-1878)

A Remote File Inclusion vulnerability has been reported in W-Agora. The vulnerability is due to lack of sanitization for user-supplied data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system. This protection was previously...

w-Agora Forum 4.2.1 - Arbitrary File Upload Exploit

No description provided by source. ?php / Title .......................: w-Agora Forum 4.2.1 Remote File Upload Exploit Site ........................: http://www.w-agora.com/en/download.php Version .....................: 4.2.1 Author ......................: Treasure Priyamal Site...

W-Agora 4.0 - moderate_notes.php bn_dir_default Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/28366/info w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the...

W-Agora 4.1.6 a download_thread.php thread Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL...

W-Agora 4.0 - create_forum.php bn_dir_default Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/28366/info w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the...