PT-2019-14513

Name of the Vulnerable Software and Affected Versions Silver Peak EdgeConnect SD-WAN versions prior to 8.1.7.x Description The issue allows directory traversal via a "rest/json/configdb/download/" URI. Recommendations For versions prior to 8.1.7.x, update to version 8.1.7.x or later to resolve th...

PT-2019-14507

Name of the Vulnerable Software and Affected Versions Silver Peak EdgeConnect SD-WAN versions prior to 8.1.7.x Description The issue allows for CSRF via JSON data to a .swf file. Recommendations For versions prior to 8.1.7.x, update to version 8.1.7.x or later to resolve the issue...

PT-2019-14511

Name of the Vulnerable Software and Affected Versions Silver Peak EdgeConnect SD-WAN versions prior to 8.1.7.x Description The issue allows privilege escalation from the menu to a root Bash OS shell via the spsshell feature, specifically affecting administrators. Recommendations For versions prio...

PT-2019-14509

Name of the Vulnerable Software and Affected Versions Silver Peak EdgeConnect SD-WAN versions prior to 8.1.7.x Description The issue allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST API, such as the "rest/json/banners" URI...

PT-2019-14512

Name of the Vulnerable Software and Affected Versions Silver Peak EdgeConnect SD-WAN versions prior to 8.1.7.x Description The issue is related to a reflected XSS attack. It can be exploited via the "rest/json/configdb/download/" API endpoint. Recommendations For versions prior to 8.1.7.x, update...

CVE-2019-16100: Undefined Security Weakness

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to trigger a web-interface outage via slow client-side HTTP traffic from a single source...

CVE-2019-16101: Generation of Error Message Containing Sensitive Information

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST API, such as the rest/json/banners URI...

CVE-2019-16104: Improper Neutralization of Input During Web Page Generation

Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATHINFO...

PT-2019-14508

Name of the Vulnerable Software and Affected Versions Silver Peak EdgeConnect SD-WAN versions prior to 8.1.7.x Description The issue allows remote attackers to cause a web-interface outage by sending slow client-side HTTP traffic from a single source. Recommendations For versions prior to 8.1.7.x...

Citrix SD-WAN Center Unauthenticated Remote Command Injection

The remote Citrix SD-WAN Center is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input in the ping action of DiagnosticController. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to execute arbitrary...

Sphinx Search Server Public WAN (Internet) / Public LAN Accessible

The script checks if the target host is running an Sphinx search server accessible from a public WAN Internet / public LAN. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2019-15513

An issue was discovered in OpenWrt libuci aka Library for the Unified Configuration Interface before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang...

Cisco IOS XE Software Short Message Service Denial of Service Vulnerability

According to its self-reported version, the installed Cisco IOS XE Software is affected by a vulnerability in its implementation of the Short Message Service SMS handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected...

D-Link DIR-600M - Authentication Bypass (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2019-13101 D-Link DIR-600M Incorrect Access Control', 'Description' = %q This module attempts to find D-Link router DIR-600M which is...

D-Link DIR-600M - Authentication Bypass (Metasploit)

D-Link DIR-600M - Authentication Bypass Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CVE-2019-13101 D-Link DIR-600M Incorrect Access Control', 'Description' = %q This module...

D-Link DIR-600M License Issue Vulnerability

The D-Link DIR-600M is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-600M, which can be exploited to allow a user to directly access the wan.htm file without authentication. The vulnerability can be exploited by an attacker to disclose...

CVE-2019-13101

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page...

CVE-2019-13101

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page...

CVE-2019-1951

A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by...

CVE-2019-1951

A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by...