CVE-2019-16101

CVE-2019-16101 affects Silver Peak EdgeConnect SD-WAN prior to version 8.1.7.x. The issue allows remote attackers to trigger the REST API by sending malformed JSON (e.g., to rest/json/banners), potentially causing the system to leak sensitive stack traces. Impact is information disclosure via sta...

CVE-2019-16101

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST API, such as the rest/json/banners URI...

CVE-2019-16102

Affected product: Silver Peak EdgeConnect SD-WAN. Vulnerability: SNMP service exposes public rocommunity and trapcommunity values in versions before 8.1.7.x. Impact: potential unauthorized access/monitoring via SNMP due to public community values. Exploitation details are not provided in the docu...

CVE-2019-16102

Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity...

CVE-2019-16103

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation by administrators from the menu to a root Bash OS shell via the spsshell feature...

CVE-2019-16103

CVE-2019-16103 concerns Silver Peak EdgeConnect SD-WAN (pre-8.1.7.x). The vulnerability allows privilege escalation from the user-facing menu to a root Bash OS shell via the spsshell feature. Affected product: EdgeConnect SD-WAN; affected versions: before 8.1.7.x. Root cause and impact: elevation...

CVE-2019-16104

Silver Peak EdgeConnect SD-WAN is affected by CVE-2019-16104. A reflected cross-site scripting (XSS) vulnerability exists in versions prior to 8.1.7.x, exploitable via the rest/json/configdb/download/ PATH_INFO exposed by the device. The issue is confirmed across multiple sources (CNVD, Red Hat/R...

CVE-2019-16105

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI...

CVE-2019-16105

Silver Peak EdgeConnect SD-WAN pre-8.1.7.x is vulnerable to directory traversal via the rest/json/configdb/download/ URI. Root cause: path traversal in the download endpoint allows access to restricted directories outside the intended path. Affected product: Silver Peak EdgeConnect SD-WAN (versio...

Citrix SD-WAN Center Unauthenticated Remote Command Injection

The remote Citrix SD-WAN Center is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input in the ping action of DiagnosticController. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to execute arbitrary...

Sphinx Search Server Public WAN (Internet) / Public LAN Accessible

The script checks if the target host is running an Sphinx search server accessible from a public WAN Internet / public LAN. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2019-15513

An issue was discovered in OpenWrt libuci aka Library for the Unified Configuration Interface before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang...

Cisco IOS XE Software Short Message Service Denial of Service Vulnerability

According to its self-reported version, the installed Cisco IOS XE Software is affected by a vulnerability in its implementation of the Short Message Service SMS handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected...

D-Link DIR-600M - Authentication Bypass (Metasploit)

D-Link DIR-600M - Authentication Bypass Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2019-13101 D-Link DIR-600M Incorrect Access Control', 'Description' = %q This module...

D-Link DIR-600M - Authentication Bypass (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2019-13101 D-Link DIR-600M Incorrect Access Control', 'Description' = %q This module attempts to find D-Link router DIR-600M which is...

D-Link DIR-600M License Issue Vulnerability

The D-Link DIR-600M is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-600M, which can be exploited to allow a user to directly access the wan.htm file without authentication. The vulnerability can be exploited by an attacker to disclose...

CVE-2019-13101

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page...

CVE-2019-13101

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page...

CVE-2019-1951

A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by...

CVE-2019-1951

A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by...