Security fix for the ALT Linux 10 package samba version 4.8.4-alt1.S1

Aug. 14, 2018 Evgeny Sinelnikov 4.8.4-alt1.S1 - Update to summer security release - Security fixes: + CVE-2018-1139 Weak authentication protocol allowed + CVE-2018-1140 Denial of Service Attack on DNS and LDAP server + CVE-2018-10858 Insufficient input validation on client directory listing in...

D-Link DIR-601 Failed Password Change Control Vulnerability

Exploit for hardware platform in category web applications Suggested description D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext. ------------------------------------------ Additional Information Insecure Authentication Practices i...

CVE-2017-12712

The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3...

PT-2018-2603 · Moxa · Moxa Iks-G6824A +2

Name of the Vulnerable Software and Affected Versions: Moxa IKS and EDS affected versions not specified Moxa IKS-G6824A affected versions not specified Description: The issue is related to cross-site request forgery, which may allow for the execution of unauthorized actions on the device. It is...

CVE-2017-17746

Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The authentication record is stored on the device; thus if an administrator authenticates from a NAT network, the...

The vulnerability of the Smart Network Configuration Manager’s automatic network configuration management system, related to authentication mechanisms that lack sufficient protection, allows attackers to circumvent network firewall restrictions.

The vulnerability of the Smart Network Configuration Manager’s automatic network configuration management system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass network firewalls by using a Zebedee client that connects t...

Huawei Honor V9 play forensic bypass vulnerability

Huawei Honor V9 play is a smartphone from Huawei Huawei. A forensic bypass vulnerability exists in the "phone retrieval" feature of the Huawei Honor V9 play. The vulnerability exists because the device does not reasonably implement the authentication feature. An attacker can exploit this...

The vulnerability of the EMC Avamar backup system allows a perpetrator to access confidential information, update software, or otherwise affect the application.

The vulnerability of the EMC Avamar backup system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to access confidential information, update software, or perform any other service-related operations...

The vulnerability of the Apache Tomcat application server allows a hacker to execute arbitrary code.

The vulnerability of the Apache Tomcat application server is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, provided that the JmxRemoteLifecycleListener handler is used and the malicious actor gains access to the...

Weblate: Open redirect in Signing in via Social Sites

Weak Authentication Leads to the Open redirection to Malicios Sites : Signing in via Facebook : + https://hosted.weblate.org/accounts/login/facebook/?next=///evil.com Signing in via Gmail : + https://hosted.weblate.org/accounts/login/google-oauth2/?next=///evil.com Signing in via Github: +...

Trend Micro Threat Discovery Appliance <= 2.6.1062r1 admin_sys_time.cgi Command Injection Remote Code Execution Vulnerability Raw（CVE-2016-8585）

Summary: There exists a post authenticated command injection vulnerability that can be used to execute arbitrary code as root. Notes: - Since this is a busybox, getting a connectback seemed hard. So, for this particular PoC, all I did was exec a bind shell using netcat. - Auth is VERY weak, no...

Trend Micro Threat Discovery Appliance <= 2.6.1062r1 (latest) log_query.cgi Command Injection Remote Code Execution Vulnerability (CVE-2016-8591)

Summary: There exists a post authenticated command injection vulnerability that can be used to execute arbitrary code as root. Notes: - Since this is a busybox, getting a connectback seemed hard. So, for this particular PoC, all I did was exec a bind shell using netcat. - Auth is VERY weak, no...

Trend Micro Threat Discovery Appliance <= 2.6.1062r1 (latest) upload.cgi Remote Code Execution Vulnerability Raw (CVE-2016-8593)

Summary: There exists a post authenticated upload vulnerability that can be used to execute arbitrary code. Notes: - Since this is a busybox, getting a connectback seemed hard. So, for this particular PoC, all I did was take command, upload bd, exec, read, rinse, repeat. - You maybe can get a...

Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_system.cgi Remote Code Execution Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a logquerysystem.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogquerysystemrce mrm...

Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query.cgi Remote Code Execution Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a logquery.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogqueryrce mrme$ ./poc.py...

Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dae.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogquerydaerce mrme$ ./poc.py 172.16.175.123 admin + logged in... + starting backdoor, this will take a few secs... + calling backdoor! id uid=0root gid=0root...

Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_system.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogquerysystemrce mrme$ ./poc.py 172.16.175.123 admin123 + logged in... + starting backdoor, this will take a few secs... + calling backdoor! id uid=0root...

Trend Micro Threat Discovery Appliance 2.6.1062r1 admin_sys_time.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoveryadminsystimerce mrme$ ./poc.py 172.16.175.123 admin123 + logged in... + starting backdoor, this will take a few secs... + calling backdoor! id uid=0root gid=0ro...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure Explo

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a dlppolicyupload.cgi information disclosure vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin /etc/passwd...

Trend Micro Threat Discovery Appliance 2.6.1062r1 admin_sys_time.cgi Remote Code Execution Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a adminsystime.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoveryadminsystimerce mrme$...