Show filters

Showing topics marked with the following tags:

(11-20 of 158)

Sort by:
Attacker Value
Very High

CVE-2020-12271: Sophos XG Firewall Pre-Auth SQL Injection Vulnerability

Disclosure Date: April 27, 2020 (last updated June 05, 2020)
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
Attack Vector: Network
2
Attacker Value
Very Low

CVE-2017-9554

Disclosure Date: July 24, 2017 (last updated July 12, 2020)
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.
Attack Vector: Network
0
Attacker Value
Very High

CVE-2016-1561

Disclosure Date: April 21, 2017 (last updated July 12, 2020)
ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image.
Attack Vector: Network
0
Attacker Value
High

CVE-2020-10915 Preauth RCE in VEEAM One Agent

Disclosure Date: April 22, 2020 (last updated July 12, 2020)
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401.
Attack Vector: Network
0
Attacker Value
High

CVE-2020-4429

Disclosure Date: April 21, 2020 (last updated July 12, 2020)
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.
Attack Vector: Network
0
Attacker Value
Unknown

CVE-2019-6447

Disclosure Date: January 16, 2019 (last updated July 12, 2020)
The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network. This TCP port remains open after the ES application has been launched once, and responds to unauthenticated application/json data over HTTP.
Attack Vector: Adjacent Network
0
Attacker Value
High

CVE-2020-2883

Disclosure Date: April 15, 2020 (last updated July 12, 2020)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Attack Vector: Network Utility Class: RCE
0
Attacker Value
Very High

CVE-2020-11651

Disclosure Date: April 30, 2020 (last updated July 12, 2020)
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
Attack Vector: Network Utility Class: RCE
3
Attacker Value
Moderate

CVE-2018-8174

Disclosure Date: May 09, 2018 (last updated June 05, 2020)
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Attack Vector: Network
0
Attacker Value
High

CVE-2020-1984

Disclosure Date: April 08, 2020 (last updated June 05, 2020)
Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:\) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.
Attack Vector: Local
0