CVE-2017-17411

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data...

CVE-2017-17411

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data...

Cambium Networks ePMP Command Injection Vulnerability

Cambium Networks ePMP is a suite of wireless network access platforms from Cambium Networks, USA. The platform provides video surveillance, Wi-Fi hotspot and sensor connectivity. A security vulnerability exists in Cambium Networks ePMP using firmware version 3.5 and prior, which stems from the We...

CVE-2017-5255

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user including the otherwise low-privilege readonly user to inject shell meta-characters as part of a specially-crafted POST request...

Design/Logic Flaw

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user including the otherwise low-privilege readonly user to inject shell meta-characters as part of a specially-crafted POST request...

CVE-2017-5255

This CVE affects Cambium Networks ePMP firmware up to v3.5. The web management console lacks input sanitation for certain parameters in the get_chart function, allowing an authenticated user (including a low-privilege readonly user) to inject shell metacharacters in a crafted POST and run OS-leve...

CVE-2017-5255

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user including the otherwise low-privilege readonly user to inject shell meta-characters as part of a specially-crafted POST request...

(0Day) Linksys WVBR0 User-Agent Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data...

Palo Alto Networks Firewalls - Root Remote Code Execution

Palo Alto Networks Firewalls - Root Remote Code Execution This is a public advisory for CVE-2017-15944 which is a remote root code execution bug in Palo Alto Networks firewalls. Three separate bugs can be used together to remotely execute commands as root through the web management interface...

Western Digital MyCloud PR4100 Web Management Component 'multi_uploadify' File Upload Vulnerability

The Western Digital MyCloud PR4100 is a networked cloud storage device from Western Digital.The web administration component is one of the web administration components. A security vulnerability exists in the Web administration component of the Western Digital MyCloud PR4100 version 2.30.172. An...

Palo Alto Networks Firewalls Remote Root Code Execution Vulnerability

Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on PAN-OS versions 6.1.18 and earlier, PAN-OS versions 7.0.18 and earlier, PAN-OS versions 7.1.13 and earlier, and PAN-OS versions 8.0.5 and earlier. Full...

Palo Alto Networks firewalls remote root code execution(CVE-2017-15944)

This is a public advisory for CVE-2017-15944 which is a remote root code execution bug in Palo Alto Networks firewalls. Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on: PAN-OS 6.1.18 and earlier, PAN-OS...

Cisco Jabber for Windows, Mac, Android and iOS Cisco Jabber Cross-Site Scripting Vulnerability (CNVD-2017-36129)

Cisco Jabber for Windows, Mac, Android and iOS is a set of unified communications client solutions for Windows, Mac, Android and iOS platforms from Cisco USA. The solution provides online status display, instant messaging, voice and other features. A cross-site scripting vulnerability exists in t...

Weak Password Vulnerability in WEB Management Interface of Pelco Sarix Pro Network Camera

pelco Sarix Professional is a video camera. A weak password vulnerability exists in the WEB management interface of the pelco Sarix Pro network camera. An attacker can obtain a hidden administrative account and use this account to perform any background operation, gain administrative privileges,...

Pelco Sarix Pro Network Camera WEB Management Interface Login Bypass Vulnerability

pelco Sarix Professional is a video camera. A login bypass vulnerability exists in the WEB management interface of the pelco Sarix Pro network camera. This allows an attacker to bypass password authentication and log in to the WEB management interface directly as an administrator...

Foscam IP Video Camera CGIProxy.fcgi SoftAP Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SoftAP configuration...

The vulnerability of the HTTP Web-management component of Edgewater Networks Edgemarc software allows a perpetrator to execute arbitrary commands.

The vulnerability of the HTTP Web-management component of Edgewater Networks Edgemarc software is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands, using a hidden page as an interface for executing these...

中兴集成多业务路由器-ZXR10 1800-2S 敏感信息泄露漏洞

介绍 ZXR10 1800-2S 路由器是中兴通讯推出的集路由、交换、无线、安全、 VPN 于一体的智能集成多业务路由器产品，凭借模块化、可扩展的系统架构，为用户构建智能、高效、可靠、灵活、易维的网络。 该路由器可广泛灵活的适用于大客户接入、 DCN、园区网、校园网、政企网的出口网关、企业的总部/分支接入、金融网点、移动办公室、行业网纵向网的汇聚/接入等网络。 CVE/CNVD/CNNVD & 厂商回应 CVE-2017-10930...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Command Injection Vulnerability(CVE-2017-2845)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tes...

Foscam IP Video Camera WebService CGI Parameter Code Execution Vulnerability(CVE-2017-2805)

Summary An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simp...