Security News

CVE-2018-11640

National Vulnerability Database - Tue, 07/03/2018 - 13:29
XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitrary files or cause a denial of service (resource consumption).
Categories: Security News

CVE-2018-11641

National Vulnerability Database - Tue, 07/03/2018 - 13:29
Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service.
Categories: Security News

CVE-2018-11642

National Vulnerability Database - Tue, 07/03/2018 - 13:29
Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows local users to execute code as the root user.
Categories: Security News

CVE-2018-11314

National Vulnerability Database - Tue, 07/03/2018 - 12:29
The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker.
Categories: Security News

CVE-2018-11316

National Vulnerability Database - Tue, 07/03/2018 - 12:29
The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker.
Categories: Security News

CVE-2018-13102

National Vulnerability Database - Tue, 07/03/2018 - 12:29
AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability.
Categories: Security News

CVE-2018-13106

National Vulnerability Database - Tue, 07/03/2018 - 12:29
ClipperCMS 1.3.3 has stored XSS via the "Tools -> Configuration" screen of the manager/ URI.
Categories: Security News

CVE-2018-7635

National Vulnerability Database - Tue, 07/03/2018 - 11:29
Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name.
Categories: Security News

CVE-2018-7774

National Vulnerability Database - Tue, 07/03/2018 - 10:29
The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the username input parameter.
Categories: Security News

CVE-2018-7775

National Vulnerability Database - Tue, 07/03/2018 - 10:29
The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sensitive data.
Categories: Security News

CVE-2018-7776

National Vulnerability Database - Tue, 07/03/2018 - 10:29
The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.
Categories: Security News

CVE-2018-7777

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric U.motion Builder software versions prior to v1.3.4, malicious clients can upload and cause the smbd server to execute a shared library from a writable share.
Categories: Security News

CVE-2018-7778

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users.
Categories: Security News

CVE-2018-7779

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric Wiser for KNX V2.1.0 and prior, homeLYnk V2.0.1 and prior; and spaceLYnk V2.1.0 and prior, weak and unprotected FTP access could allow an attacker unauthorized access.
Categories: Security News

CVE-2018-7780

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi program "set".
Categories: Security News

CVE-2018-7781

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authenticated user can view password in clear text and results in privilege escalation.
Categories: Security News

CVE-2018-7782

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text.
Categories: Security News

CVE-2018-7783

National Vulnerability Database - Tue, 07/03/2018 - 10:29
Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
Categories: Security News

CVE-2018-7784

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application.
Categories: Security News

CVE-2018-7785

National Vulnerability Database - Tue, 07/03/2018 - 10:29
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass.
Categories: Security News

Pages