SEC Consult Vulnerability Lab Security Advisory < 20200123-0 >
===
title: Cross-Site Request Forgery (CSRF)
product: Umbraco CMS
vulnerable version: version 8.2.2
fixed version: versi
SEC Consult Vulnerability Lab Security Advisory < 20200122-0 >
===
title: Reflected XSS
product: ZOHO ManageEngine ServiceDeskPlus
vulnerable version: <= 11.0 Build 11007
fixed version: 1
SEC Consult Vulnerability Lab Security Advisory < 20191211-0 >
===
title: File Extension Spoofing
product: Windows Defender Antivirus
vulnerable version: 4.18.1908.7-0
fixed version:
SEC Consult Vulnerability Lab Security Advisory < 20191203-0 >
===
title: Multiple vulnerabilites
product: Fronius Solar Inverter Series
vulnerable version: SW Version <3.14.1 (HM 1.12.1)
SEC Consult Vulnerability Lab Security Advisory < 20191202-0 >
===
title: Multiple Critical Vulnerabilities
product: SALTO ProAccess SPACE
vulnerable version: <= v5.5
fixed version
Vulnerability Lab
On 25.11.19 14:43, SEC Consult Vulnerability Lab wrote:
> SEC Consult Vulnerability Lab Security Advisory < 20191125-0 >
> ===
> title: FortiGuard XOR Encryption
> product:
SEC Consult Vulnerability Lab Security Advisory < 20191125-0 >
===
title: FortiGuard XOR Encryption
product: Multiple Fortinet Products (see Vulnerable / tested
versions)
vulnerable version: Mu
SEC Consult Vulnerability Lab Security Advisory < 20191014-0 >
===
title: Reflected XSS vulnerability
product: OpenProject
vulnerable version: <= 9.0.3, <=10.0.1
fixed version: 9
SEC Consult Vulnerability Lab Security Advisory < 20190926-0 >
===
title: Multiple SQL Injection vulnerabilities
product: eBrigade
vulnerable version: <5.0
fixed version: >=5.0
SEC Consult Vulnerability Lab Security Advisory < 20190918-0 >
===
title: Reflected Cross-Site Scripting (XSS)
product: Oracle Mojarra JSF included in Java EE 7
Eclipse Mojar
SEC Consult Vulnerability Lab Security Advisory < 20190912-0 >
===
title: Stored and reflected XSS vulnerabilities
product: LimeSurvey
vulnerable version: <= 3.17.13
fixed version:
SEC Consult Vulnerability Lab Security Advisory < 20190904-0 >
===
title: Multiple vulnerabilities
product: Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P,
Cisco RV260,
SEC Consult Vulnerability Lab Security Advisory < 20190829-1 >
===
title: External DNS Requests
product: Zyxel USG/UAG/ATP/VPN/NXC series
vulnerable version: see "Vulnerable / tested version&q
SEC Consult Vulnerability Lab Security Advisory < 20190829-0 >
===
title: Hardcoded FTP Credentials
product: Zyxel NWA/NAP/WAC wireless access point series
vulnerable version: see "Vulnerab
SEC Consult Vulnerability Lab Security Advisory < 20190822-0 >
===
title: Multiple Vulnerabilities
product: OpenPGP.js
vulnerable version: <=4.2.0
fixed version: 4.3.0
CVE number:
SEC Consult Vulnerability Lab Security Advisory < 20190821-0 >
===
title: Unauthenticated sensitive information leakage
product: Zoho Corporation ManageEngine ServiceDesk Plus
vulnerable versio
SEC Consult Vulnerability Lab Security Advisory < 20190612-0 >
===
title: Multiple vulnerabilities
product: WAGO 852 Industrial Managed Switch Series
vulnerable version: 852-303: https://www.wa
SEC Consult Vulnerability Lab Security Advisory < 20190515-0 >
===
title: Authorization Bypass
product: RSA NetWitness
vulnerable version: <10.6.6.1, <11.2.1.1
fixed version: 10.6.6
SEC Consult Vulnerability Lab Security Advisory < 20190513-0 >
===
title: Cleartext message spoofing
product: Supplementary Go Cryptography Libraries
vulnerable version:
SEC Consult Vulnerability Lab Security Advisory < 20190510-0 >
===
title: Unauthenticated SQL Injection vulnerability
product: OpenProject
vulnerable version: 5.0.0 - 8.3.1
fixed version:
SEC Consult Vulnerability Lab Security Advisory < 20190509-0 >
===
title: Multiple Vulnerabilities
product: Gemalto (Thales Group) DS3 Authentication Server / Ezio
Server
vuln
A blog post with further information has been released on this topic as well:
https://r.sec-consult.com/osci
SEC Consult Vulnerability Lab Security Advisory < 20190205-0 >
===
title: Multiple vulnerabi
SEC Consult Vulnerability Lab Security Advisory < 20190124-0 >
===
title: Cross-site scripting
product: CA Automic Workload Automation Web Interface (AWI)
(formerly Automic Auto
SEC Consult Vulnerability Lab Security Advisory < 20190109-0 >
===
title: Multiple Vulnerabilities
product: Cisco VoIP Phones, e.g. models 88XX
vulnerable version: See list of vulnerable d
SEC Consult Vulnerability Lab Security Advisory < 20181205-0 >
===
title: Inadequate cryptography implementation
product: Kerio Control VPN protocol
vulnerable version: <=9.2.7
fixed versi
SEC Consult Vulnerability Lab Security Advisory < 20181130-0 >
===
title: Multiple Vulnerabilities
product: Siglent Technologies SDS 1202X-E Digital Oscilloscope
vulnerable version: V5.1.3.13
An additional blog post has been published on this topic as well:
English version: https://r.sec-consult.com/governikus
German version: https://r.sec-consult.com/gov
SEC Consult Vulnerability Lab Security Advisory < 2018112
SEC Consult Vulnerability Lab Security Advisory < 20181116-0 >
===
title: Multiple critical vulnerabilities
product: Miss Marple Enterprise Edition
vulnerable version: <2.0
fixed ver
SEC Consult Vulnerability Lab Security Advisory < 20181114-0 >
===
title: Denial of Service
product: Microsoft Skype for Business 2016 / Lync 2013
vulnerable version: Microsoft Skype for Busines
SEC Consult also published a blog post regarding the identified security issues
with further background information:
Blog: https://r.sec-consult.com/xmeye
SEC Consult Vulnerability Lab Security Advisory < 2018100
SEC Consult Vulnerability Lab Security Advisory < 20181001-0 >
===
title: Password disclosure vulnerability & XSS
product: PTC ThingWorx
vulnerable version: 6.5-7.4, 8.0.x, 8.1.x, 8.2.x
SEC Consult Vulnerability Lab Security Advisory < 20180926-0 >
===
title: Stored Cross-Site Scripting
product: Progress Kendo UI Editor
vulnerable version: v2018.1.221
fixed version: non
here with correct email subject :)
On 9/26/18 2:17 PM, SEC Consult Vulnerability Lab wrote:
> SEC Consult Vulnerability Lab Security Advisory < 20180926-0 >
> ===
> title: Stored Cross
SEC Consult Vulnerability Lab Security Advisory < 20180924-0 >
===
title: Multiple Vulnerabilities
product: Citrix StorageZones Controller
vulnerable version: all versions before 5.4.2
SEC Consult Vulnerability Lab Security Advisory < 20180918-0 >
===
title: Remote Code Execution via PHP unserialize
product: Moodle - Open-source learning platform
vulnerable version: 3.5 to 3.5.
SEC Consult Vulnerability Lab Security Advisory < 20180906-0 >
===
title: CSV Formula Injection
product: DokuWiki
vulnerable version: 2018-04-22a "Greebo" and older versions
fix
SEC Consult Vulnerability Lab Security Advisory < 20180813-0 >
===
title: SQL Injection, XSS & CSRF vulnerabilities
product: Pimcore
vulnerable version: 5.2.3 and below
fixed vers
SEC Consult Vulnerability Lab Security Advisory < 20180712-0 >
===
title: Remote Code Execution & Local File Disclosure
product: Zeta Producer Desktop CMS
vulnerable version: <=14.2.0
SEC Consult Vulnerability Lab Security Advisory < 20180711-0 >
===
title: Remote code execution via multiple attack vectors
product: WAGO e!DISPLAY 7300T - WP 4.3 480x272 PIO1
vulnerable version:
:
https://www.sec-consult.com/en/blog/advisories/authorization-bypass-in-all-adb-broadband-gateways-routers/
SEC Consult Vulnerability Lab Security Advisory < 20180704-2 >
===
title: Privilege escalation via linux
:
https://www.sec-consult.com/en/blog/advisories/privilege-escalation-via-linux-group-manipulation-in-all-adb-broadband-gateways-routers/
SEC Consult Vulnerability Lab Security Advisory < 20180704-1 >
===
-consult.com/en/blog/advisories/privilege-escalation-via-linux-group-manipulation-in-all-adb-broadband-gateways-routers/
SEC Consult Vulnerability Lab Security Advisory < 20180704-0 >
===
title: Local root jailbre
SEC Consult Vulnerability Lab Security Advisory < 20180516-0 >
===
title: XXE & XSS vulnerabilities
product: RSA Authentication Manager
vulnerable version: 8.2.1.4.0-build1394922, < 8.3 P
The following CVE numbers have been assigned now:
XSS issue: CVE-2018-11090
Arbitrary File Upload: CVE-2018-11091
On 2018-05-14 13:25, SEC Consult Vulnerability Lab wrote:
> SEC Consult Vulnerability Lab Security Advisory < 2018
SEC Consult Vulnerability Lab Security Advisory < 20180514-0 >
===
title: Arbitrary File Upload & Cross-site scripting
product: MyBiz MyProcureNet
vulnerable version: 5.0.0
fixed versio
We have published an accompanying blog post to this technical advisory with
further information:
Blog:
https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/
Demo video: https://www.youtube.com/watch?v=YK7_1NozAwQ
SEC Consult Vulnerability Lab Security Advisory
SEC Consult Vulnerability Lab Security Advisory < 20180424-0 >
===
title: Reflected Cross-Site Scripting
product: Zyxel ZyWALL: see "Vulnerable / tested version"
vulnerable version: ZLD
SEC Consult Vulnerability Lab Security Advisory < 20180423-0 >
===
title: Multiple Stored XSS Vulnerabilities
product: WSO2 Carbon, WSO2 Dashboard Server
vulnerable version: WSO2 Identity Server
SEC Consult Vulnerability Lab Security Advisory < 20180314-0 >
===
title: Arbitrary Shortcode Execution & Local File Inclusion
product: WOOF - WooCommerce Products Filter (PluginUs.Net)
SEC Consult Vulnerability Lab Security Advisory < 20180312-0 >
===
title: Multiple Critical Vulnerabilities
product: SecurEnvoy SecurMail
vulnerable version: 9.1.501
fixed version: 9
SEC Consult Vulnerability Lab Security Advisory < 20180228-0 >
===
title: Insecure Direct Object Reference
product: TestLink Open Source Test Management
vulnerable version: <1.9.17
fixe
SEC Consult Vulnerability Lab Security Advisory < 20180227-0 >
===
title: OS command injection, arbitrary file upload & SQL injection
product: ClipBucket
vulnerable version: <4.0.0 -
We have published an accompanying blog post to this technical advisory with
further information:
https://www.sec-consult.com/en/blog/2018/02/internet-of-babies-when-baby-monitors-fail-to-be-smart/index.html
SEC Consult Vulnerability Lab Security Advisory < 2018022
SEC Consult Vulnerability Lab Security Advisory < 20180208-0 >
===
title: Multiple Cross-Site Scripting Vulnerabilities
product: Sonatype Nexus Repository Manager OSS/Pro
vulnerable version: &l
SEC Consult Vulnerability Lab Security Advisory < 20180207-0 >
===
title: Multiple buffer overflow vulnerabilities
product: InfoZip UnZip
vulnerable version: UnZip <= 6.00 / UnZip <= 6.1c22
We have published an accompanying blog post to this technical advisory with
further information:
https://www.sec-consult.com/en/blog/2018/02/internet-of-dildos-a-long-way-to-a-vibrant-future-from-iot-to-iod/index.html
SEC Consult Vulnerability Lab Security Advisory < 2018020
SEC Consult Vulnerability Lab Security Advisory < 20180131-0 >
===
title: Multiple Vulnerabilities
product: Sprecher Automation SPRECON-E-C, PU-2433
vulnerable version: <8.49 (most vulnerabili
SEC Consult Vulnerability Lab Security Advisory < 20180123-0 >
===
title: XXE & Reflected XSS
product: Oracle Financial Services Analytical Applications
vulnerable version: 7.3.5.x, 8.0.x
SEC Consult Vulnerability Lab Security Advisory < 20171018-1 >
===
title: Multiple vulnerabilities
product: Linksys E series, see "Vulnerable / tested versions"
vulnerable version:
SEC Consult Vulnerability Lab Security Advisory < 20171016-0 >
===
title: Multiple vulnerabilities
product: Micro Focus VisiBroker C++
vulnerable version: 8.5 SP2
fixed version: 8.5 S
SEC Consult Vulnerability Lab Security Advisory < 20170912-0 >
===
title: Email verification bypass
product: SAP E-Recruiting
vulnerable version: 605, 606, 616, 617
fixed version: see SAP se
SEC Consult Vulnerability Lab Security Advisory < 20170804-0 >
===
title: Server Side Request Forgery Vulnerability
product: phpBB
vulnerable version: 3.2.0
fixed version: 3.2.1
CVE
SEC Consult Vulnerability Lab Security Advisory < 20170804-1 >
===
title: Authenticated Command Injection
product: Ubiquiti Networks UniFi Cloud Key
vulnerable version: Firmware v0.6.1
SEC Consult Vulnerability Lab Security Advisory < 20170724-0 >
===
title: Cross-Site Scripting (XSS)
product: Ubiquiti Networks EP-R6, ER-X, ER-X-SFP
vulnerable version: Firmware v1.9.1
SEC Consult Vulnerability Lab Security Advisory < 20170724-1 >
===
title: Open Redirect in Login Page
product: Multiple Ubiquiti Networks products, e.g.
TS-16-CARRIER, TS-5-POE
SEC Consult Vulnerability Lab Security Advisory < 20170712-0 >
===
title: Multiple critical vulnerabilities
product: AGFEO Smart Home ES 5xx
AGFEO Smart Home ES 6xx
vuln
descriptions:
http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html
SEC Consult Vulnerability Lab Security Advisory < 20170630-0 >
===
title: Multiple critical vulnerabi
SEC Consult Vulnerability Lab Security Advisory < 20170613-0 >
===
title: Access Restriction Bypass
product: Atlassian Confluence
vulnerable version: 4.3.0 - 6.1.1
fixed version: 6.2.1
A short demo video is available here:
https://youtu.be/0jZdM9peVSk
SEC Consult Vulnerability Lab Security Advisory < 20170510-0 >
===
title: Insecure Handling Of URI Schemes
product: Microsoft On
SEC Consult Vulnerability Lab Security Advisory < 20170509-0 >
===
title: Multiple vulnerabilities
product: I, Librarian PDF manager
vulnerable version: <=4.6 & 4.7
fixed version: 4.8
SEC Consult Vulnerability Lab Security Advisory < 20170407-0 >
===
title: Server Side Request Forgery (SSRF) Vulnerability
product: MyBB
vulnerable version: 1.8.10
fixed version:
SEC Consult Vulnerability Lab Security Advisory < 20170403-0 >
===
title: Misbehavior of the "fsockopen" function
product: PHP
vulnerable version: 7.1.2
fixed version:
CVE
SEC Consult Vulnerability Lab Security Advisory < 20170322-0 >
===
title: Multiple vulnerabilities
product: Solare Datensysteme GmbH
Solar-Log 250/300/500/800e/1000/1000 PM+/120
SEC Consult Vulnerability Lab Security Advisory < 20170316-0 >
===
title: Authenticated Command Injection
product: Multiple Ubiquiti Networks products, e.g.
TS-16-CARRIER, TS
SEC Consult Vulnerability Lab Security Advisory < 20170308-0 >
===
title: Multiple vulnerabilities
product: Navetti PricePoint
vulnerable version: 4.6.0.0
fixed version: 4.7.0.0 or
SEC Consult Vulnerability Lab Security Advisory < 20170307-0 >
===
title: Unauthenticated OS command injection & arbitrary file
upload
product: Western Digital My Cloud
vulnerable version
SEC Consult Vulnerability Lab Security Advisory < 20170207-0 >
===
title: Path Traversal, Backdoor accounts & KNX group address
password bypass
product: JUNG Smart V
SEC Consult Vulnerability Lab Security Advisory < 20161128-0 >
===
title: Denial of service & heap-based buffer overflow
product: Guidance Software EnCase Forensic Imager & EnCase Forens
SEC Consult Vulnerability Lab Security Advisory < 20161114-0 >
===
title: Multiple vulnerabilities
product: I-Panda SolarEagle - Solar Controller Administration
Software / MPPT
SEC Consult Vulnerability Lab Security Advisory < 20161011-0 >
===
title: XML External Entity Injection (XXE)
product: RSA Enterprise Compromise Assessment Tool (ECAT)
vulnerable version: 4
SEC Consult Vulnerability Lab Security Advisory < 20160825-0 >
===
title: Multiple vulnerabilities
product: Micro Focus GroupWise
vulnerable version: GroupWise 2014 R2
SEC Consult Vulnerability Lab Security Advisory < 20160725-0 >
===
title: Multiple vulnerabilities
product: Micro Focus (former Novell) Filr Appliance
vulnerable version: Filr 2 <=2.0.0.421,
SEC Consult Vulnerability Lab Security Advisory < 20160624-0 >
===
title: XSS and information disclosure vulnerability
product: ASUS DSL-N55U router
vulnerable version: 3.0.0.4.376_2736
SEC Consult Vulnerability Lab Security Advisory < 20160602-0 >
===
title: Multiple critical vulnerabilities
product: Ubee EVW3226 Advanced wireless voice gateway
vulnerable version: Fi
SEC Consult Vulnerability Lab Security Advisory < publishing date 20160422-1 >
===
title: Multiple vulnerabilities in Digitalstrom Konfigurator
product: Digitalstrom Konfigurator
vulnerable v
SEC Consult Vulnerability Lab Security Advisory < 20160422-0 >
===
title: Insecure data storage
product: my devolo - android application - air.de.devolo.my.devolo
vulnerable version: 1.2.8
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
SEC Consult Vulnerability Lab Security Advisory < 20160210-0 >
===
title: Multiple Vulnerabilities
product: Yeager CMS
vulnerable version:
for more information.
SEC Consult Vulnerability Lab Security Advisory < 20160121-0 >
===
title: Deliberately hidden backdoor account
product: Several AMX (HARMAN Professional) device
SEC Consult Vulnerability Lab released a new whitepaper titled:
"Bypassing McAfee Application Whitelisting for Critical Infrastructure Systems"
- the dinosaurs want their vuln back
Link to blog overview:
--
Including slides from presentations on this topic (wi
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
SEC Consult Vulnerability Lab Security Advisory < 20151210-0 >
===
title: Multiple Vulnerabilities
product: Skybox Platform
vulnerable version: <
SEC Consult Vulnerability Lab Security Advisory < 20151105-0 >
===
title: Insecure default configuration
product: various Ubiquiti Networks products
vulnerable version: see Vulnerable / tested ve
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SEC Consult Vulnerability Lab Security Advisory < 20151022-0 >
===
title: Multiple critical vulnerabilities
product: Lime Survey
vulnerable version: 2
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SEC Consult Vulnerability Lab Security Advisory 20150805-0
===
title: Stack buffer overflow in handle_debug_network
product: Websense Triton Content
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SEC Consult Vulnerability Lab Security Advisory 20150728-0
===
title: McAfee Application Control Multiple Vulnerabilities
product: McAfee Application
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SEC Consult Vulnerability Lab Security Advisory 20150716-0
===
title: Permanent Cross-Site Scripting
product: Oracle Application Express
vulnerable
SEC Consult Vulnerability Lab Security Advisory 20150514-0
===
title: Multiple vulnerabilities
product: Loxone Smart Home
vulnerable version: Firmware version 6.4.5.12
fixed version: 6.4.5.12
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SEC Consult Vulnerability Lab Security Advisory 20150513-0
===
title: Multiple critical vulnerabilities
product: WSO2 Identity Server
SEC Consult Vulnerability Lab Security Advisory 20150410-0
===
title: Unauthenticated Local File Disclosure
product: Multiple TP-LINK products (see Vulnerable / tested
versions)
vulnerable version
SEC Consult Vulnerability Lab Security Advisory 20150409-0
===
title: Multiple XSS XSRF vulnerabilities
product: Comalatech Comala Workflows
vulnerable version: = 4.6.1
fixed version: 4.6.2
SEC Consult Vulnerability Lab Security Advisory 20150227-0
===
title: Multiple vulnerabilities
product: Loxone Smart Home
vulnerable version: Firmware: 5.49; Android-App: 3.4.1
fixed version: 6.3
1 - 100 of 180 matches
Mail list logo
