CVE-2019-16100

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to trigger a web-interface outage via slow client-side HTTP traffic from a single source...

Privilege escalation

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation by administrators from the menu to a root Bash OS shell via the spsshell feature...

Design/Logic Flaw

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to trigger a web-interface outage via slow client-side HTTP traffic from a single source...

Directory traversal

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI...

Cross site scripting

Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATHINFO...

CVE-2019-16099

CVE-2019-16099 affects Silver Peak EdgeConnect SD-WAN versions prior to 8.1.7.x. The issue is a cross-site request forgery (CSRF) that can be triggered by sending JSON data to a .swf file, enabling an attacker to cause unintended requests on a vulnerable device. Public details in connected docume...

CVE-2019-16100

CVE-2019-16100 concerns Silver Peak EdgeConnect SD-WAN (pre-8.1.7.x). The Red Hat advisory and NVD entry describe that remote attackers can trigger a web-interface outage by sending slow client-side HTTP traffic from a single source, affecting the web UI. Affected product: Silver Peak EdgeConnect...

CVE-2019-16101

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST API, such as the rest/json/banners URI...

CVE-2019-16101

CVE-2019-16101 affects Silver Peak EdgeConnect SD-WAN prior to version 8.1.7.x. The issue allows remote attackers to trigger the REST API by sending malformed JSON (e.g., to rest/json/banners), potentially causing the system to leak sensitive stack traces. Impact is information disclosure via sta...

CVE-2019-16102

Affected product: Silver Peak EdgeConnect SD-WAN. Vulnerability: SNMP service exposes public rocommunity and trapcommunity values in versions before 8.1.7.x. Impact: potential unauthorized access/monitoring via SNMP due to public community values. Exploitation details are not provided in the docu...

CVE-2019-16102

Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity...

CVE-2019-16103

CVE-2019-16103 concerns Silver Peak EdgeConnect SD-WAN (pre-8.1.7.x). The vulnerability allows privilege escalation from the user-facing menu to a root Bash OS shell via the spsshell feature. Affected product: EdgeConnect SD-WAN; affected versions: before 8.1.7.x. Root cause and impact: elevation...

CVE-2019-16103

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation by administrators from the menu to a root Bash OS shell via the spsshell feature...

CVE-2019-16104

Silver Peak EdgeConnect SD-WAN is affected by CVE-2019-16104. A reflected cross-site scripting (XSS) vulnerability exists in versions prior to 8.1.7.x, exploitable via the rest/json/configdb/download/ PATH_INFO exposed by the device. The issue is confirmed across multiple sources (CNVD, Red Hat/R...

CVE-2019-16105

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI...

CVE-2019-16105

Silver Peak EdgeConnect SD-WAN pre-8.1.7.x is vulnerable to directory traversal via the rest/json/configdb/download/ URI. Root cause: path traversal in the download endpoint allows access to restricted directories outside the intended path. Affected product: Silver Peak EdgeConnect SD-WAN (versio...

Citrix SD-WAN Center Unauthenticated Remote Command Injection

The remote Citrix SD-WAN Center is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input in the ping action of DiagnosticController. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to execute arbitrary...

Sphinx Search Server Public WAN (Internet) / Public LAN Accessible

The script checks if the target host is running an Sphinx search server accessible from a public WAN Internet / public LAN. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2019-15513

An issue was discovered in OpenWrt libuci aka Library for the Unified Configuration Interface before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang...

Cisco IOS XE Software Short Message Service Denial of Service Vulnerability

According to its self-reported version, the installed Cisco IOS XE Software is affected by a vulnerability in its implementation of the Short Message Service SMS handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected...