[FD] SEC Consult SA-20170511-0 :: Stack-based buffer overflow vulnerability in Guidance Software EnCase Forensic Imager

A blog post with additional information is available here: http://blog.sec-consult.com/2017/05/chainsaw-of-custody-manipulating.html We have also released a video showing arbitrary code execution: https://www.youtube.com/watch?v=1EngNIXSNQw SEC Consult Vulnerability Lab Security Advisory

[FD] SEC Consult SA-20170509-0 :: Multiple vulnerabilities in I, Librarian PDF manager

SEC Consult Vulnerability Lab Security Advisory < 20170509-0 > === title: Multiple vulnerabilities product: I, Librarian PDF manager vulnerable version: <=4.6 & 4.7 fixed version: 4.8

[FD] SEC Consult SA-20170622-0 :: XXE, SQLi, XSS & local file disclosure in Cisco Prime Infrastructure

SEC Consult Vulnerability Lab Security Advisory < 20170622-0 > === title: XML External Entity Injection (XXE), SQL Injection, Cross Site Scripting, Local File Disc

[FD] SEC Consult SA-20170523-0 :: Arbitrary File Upload & Stored XSS in InvoicePlane

SEC Consult Vulnerability Lab Security Advisory < 20170523-0 > === title: Arbitrary File Upload & Stored XSS product: InvoicePlane vulnerable version: 1.4.10 fixed version: 1.5.2

[FD] SEC Consult SA-20170607-0 :: Various WiMAX CPEs Authentication Bypass

We have published an accompanying blog post to this technical advisory with further information: http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html SEC Consult Vulnerability Lab Security Advisory < 2017060

[FD] SEC Consult SA-20170613-0 :: Access Restriction Bypass in Atlassian Confluence

SEC Consult Vulnerability Lab Security Advisory < 20170613-0 > === title: Access Restriction Bypass product: Atlassian Confluence vulnerable version: 4.3.0 - 6.1.1 fixed version: 6.2.1

[FD] SEC Consult SA-20170914-0 :: Authenticated Command Injection in Ubiquiti Networks UniFi Cloud Key

SEC Consult Vulnerability Lab Security Advisory < 20170914-0 > === title: Authenticated Command Injection product: Ubiquiti Networks UniFi Cloud Key vulnerable version: Firmware version &

[FD] SEC Consult SA-20170914-1 :: Persistent Cross-Site Scripting in SilverStripe CMS

SEC Consult Vulnerability Lab Security Advisory < 20170914-1 > === title: Persistent Cross-Site Scripting product: SilverStripe CMS vulnerable version: <=3.5.3 fixed versi

[FD] SEC Consult SA-20171016-0 :: Multiple vulnerabilities in Micro Focus VisiBroker C++

SEC Consult Vulnerability Lab Security Advisory < 20171016-0 > === title: Multiple vulnerabilities product: Micro Focus VisiBroker C++ vulnerable version: 8.5 SP2 fixed version: 8.5 S

[FD] SEC Consult SA-20171017-0 :: Cross site scripting in Webtrekk Pixel tracking component

SEC Consult Vulnerability Lab Security Advisory < 20171017-0 > === title: Cross site scripting product: Webtrekk Pixel tracking vulnerable version: v3.24 to v3.40, v4.00 to v4.40, v5.00 to

[FD] SEC Consult SA-20170913-1 :: Local File Disclosure in VLC media player iOS app

SEC Consult Vulnerability Lab Security Advisory < 20170913-1 > === title: Local File Disclosure product: VLC media player iOS app vulnerable version: 2.7.8 fixed version: 2.8.1 CVE

[FD] SEC Consult SA-20170913-0 :: Multiple Vulnerabilities in IBM Infosphere Information Server / Datastage

SEC Consult Vulnerability Lab Security Advisory < 20170913-0 > === title: Multiple Vulnerabilities product: IBM Infosphere Information Server / Datastage vulnerable version: 9.1, 11.3, an

[FD] SEC Consult SA-20170912-0 :: Email verification bypass in SAP E-Recruiting

SEC Consult Vulnerability Lab Security Advisory < 20170912-0 > === title: Email verification bypass product: SAP E-Recruiting vulnerable version: 605, 606, 616, 617 fixed version: see SAP se

[FD] SEC Consult SA-20171018-0 :: Multiple vulnerabilities in Afian AB FileRun

SEC Consult Vulnerability Lab Security Advisory < 20171018-0 > === title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017

[FD] SEC Consult SA-20171018-1 :: Multiple vulnerabilities in Linksys E-series products

SEC Consult Vulnerability Lab Security Advisory < 20171018-1 > === title: Multiple vulnerabilities product: Linksys E series, see "Vulnerable / tested versions" vulnerable version:

[FD] SEC Consult SA-20171130-1 :: OS Command Injection & Reflected Cross Site Scripting in OpenEMR

SEC Consult Vulnerability Lab Security Advisory < 20171130-1 > === title: OS Command Injection & Reflected Cross Site Scripting product: OpenEMR vulnerable version: 5.0.0 fixed vers

[FD] SEC Consult SA-20171129-0 :: FortiGate SSL VPN Portal XSS Vulnerability

SEC Consult Vulnerability Lab Security Advisory < 20171129-0 > === title: FortiGate SSL VPN Portal XSS Vulnerability product: Fortinet FortiOS vulnerable version: see: Vulnerable / tested ve

[FD] SEC Consult SA-20171213-0 :: VPN credentials disclosure in Fortinet FortiClient

SEC Consult Vulnerability Lab Security Advisory < 20171213-0 > === title: VPN credentials disclosure product: Fortinet FortiClient vulnerable version: <4.4.2335 on Linux, <5.6.

[FD] SEC Consult SA-20171114-0 :: Authentication bypass, cross-site scripting & code execution in Siemens SICAM RTUs SM-2556 COM Modules

SEC Consult Vulnerability Lab Security Advisory < 20171114-0 > === title: Authentication bypass, cross-site scripting & code execution product: Siemens SICAM RTUs SM-2556 C

[FD] SEC Consult SA-20171116-0 :: Broken access control & LINQ injection in Progress Sitefinity

SEC Consult Vulnerability Lab Security Advisory < 20171116-0 > === title: Broken access control & LINQ injection product: Progress Sitefinity vulnerable version: 10.0, 10.1 fix

[FD] SEC Consult SA-20180514-0 :: Arbitrary File Upload & Cross-site scripting in MyBiz MyProcureNet

SEC Consult Vulnerability Lab Security Advisory < 20180514-0 > === title: Arbitrary File Upload & Cross-site scripting product: MyBiz MyProcureNet vulnerable version: 5.0.0 fixed versio

Re: [FD] SEC Consult SA-20180514-0 :: Arbitrary File Upload & Cross-site scripting in MyBiz MyProcureNet

The following CVE numbers have been assigned now: XSS issue: CVE-2018-11090 Arbitrary File Upload: CVE-2018-11091 On 2018-05-14 13:25, SEC Consult Vulnerability Lab wrote: > SEC Consult Vulnerability Lab Security Advisory < 2018

[FD] SEC Consult SA-20180516-0 :: XXE & XSS vulnerabilities in RSA Authentication Manager

SEC Consult Vulnerability Lab Security Advisory < 20180516-0 > === title: XXE & XSS vulnerabilities product: RSA Authentication Manager vulnerable version: 8.2.1.4.0-build1394922, < 8.3 P

[FD] SEC Consult SA-20180529-0 :: Unprotected WiFi access & Unencrypted data transfer in Vgate iCar2 OBD2 Dongle

SEC Consult Vulnerability Lab Security Advisory < 20180529-0 > === title: Unprotected WiFi access & Unencrypted data transfer product: Vgate iCar 2 WiFi OBD2 Dongle vulnerable version: Vgate i

[FD] SEC Consult SA-20180503-0 :: Authentication Bypass in Oracle Access Manager (OAM)

We have published an accompanying blog post to this technical advisory with further information: Blog: https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/ Demo video: https://www.youtube.com/watch?v=YK7_1NozAwQ SEC Consult Vulnerability Lab Security Advisory

[FD] SEC Consult SA-20180123-0 :: XXE & Reflected XSS in Oracle Financial Services Analytical Applications

SEC Consult Vulnerability Lab Security Advisory < 20180123-0 > === title: XXE & Reflected XSS product: Oracle Financial Services Analytical Applications vulnerable version: 7.3.5.x, 8.0.x

[FD] SEC Consult SA-20180131-0 :: Multiple Vulnerabilities in Sprecher Automation SPRECON-E-C, PU-2433

SEC Consult Vulnerability Lab Security Advisory < 20180131-0 > === title: Multiple Vulnerabilities product: Sprecher Automation SPRECON-E-C, PU-2433 vulnerable version: <8.49 (most vulnerabili

[FD] SEC Consult SA-20180201-0 :: Multiple critical vulnerabilities in Whole Vibratissimo Smart Sex Toy product range

We have published an accompanying blog post to this technical advisory with further information: https://www.sec-consult.com/en/blog/2018/02/internet-of-dildos-a-long-way-to-a-vibrant-future-from-iot-to-iod/index.html SEC Consult Vulnerability Lab Security Advisory < 2018020

[FD] SEC Consult SA-20180208-0 :: Multiple Cross-Site Scripting Vulnerabilities in Sonatype Nexus Repository Manager OSS/Pro

SEC Consult Vulnerability Lab Security Advisory < 20180208-0 > === title: Multiple Cross-Site Scripting Vulnerabilities product: Sonatype Nexus Repository Manager OSS/Pro vulnerable version: &l

[FD] SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip

SEC Consult Vulnerability Lab Security Advisory < 20180207-0 > === title: Multiple buffer overflow vulnerabilities product: InfoZip UnZip vulnerable version: UnZip <= 6.00 / UnZip <= 6.1c22

[FD] SEC Consult SA-20180221-0 :: Hijacking of arbitrary miSafes Mi-Cam video baby monitors

We have published an accompanying blog post to this technical advisory with further information: https://www.sec-consult.com/en/blog/2018/02/internet-of-babies-when-baby-monitors-fail-to-be-smart/index.html SEC Consult Vulnerability Lab Security Advisory < 2018022

[FD] SEC Consult SA-20180813-0 :: SQL Injection, XSS & CSRF vulnerabilities in Pimcore

SEC Consult Vulnerability Lab Security Advisory < 20180813-0 > === title: SQL Injection, XSS & CSRF vulnerabilities product: Pimcore vulnerable version: 5.2.3 and below fixed vers

[FD] SEC Consult SA-20180906-0 :: CSV Formula Injection in DokuWiki

SEC Consult Vulnerability Lab Security Advisory < 20180906-0 > === title: CSV Formula Injection product: DokuWiki vulnerable version: 2018-04-22a "Greebo" and older versions fix

[FD] SEC Consult SA-20180704-0 :: Local root jailbreak via network file sharing flaw in all ADB Broadband Gateways / Routers

-consult.com/en/blog/advisories/privilege-escalation-via-linux-group-manipulation-in-all-adb-broadband-gateways-routers/ SEC Consult Vulnerability Lab Security Advisory < 20180704-0 > === title: Local root jailbre

[FD] SEC Consult SA-20180711-0 :: Remote code execution via multiple attack vectors in WAGO e!DISPLAY 7300T

SEC Consult Vulnerability Lab Security Advisory < 20180711-0 > === title: Remote code execution via multiple attack vectors product: WAGO e!DISPLAY 7300T - WP 4.3 480x272 PIO1 vulnerable version:

[FD] SEC Consult SA-20180712-0 :: Remote Code Execution & Local File Disclosure in Zeta Producer Desktop CMS

SEC Consult Vulnerability Lab Security Advisory < 20180712-0 > === title: Remote Code Execution & Local File Disclosure product: Zeta Producer Desktop CMS vulnerable version

[FD] SEC Consult SA-20180312-0 :: Multiple Critical Vulnerabilities in SecurEnvoy SecurMail

SEC Consult Vulnerability Lab Security Advisory < 20180312-0 > === title: Multiple Critical Vulnerabilities product: SecurEnvoy SecurMail vulnerable version: 9.1.501 fixed version: 9

[FD] SEC Consult SA-20180314-0 :: Arbitrary Shortcode Execution & Local File Inclusion in WooCommerce Products Filter (PluginUs.Net)

SEC Consult Vulnerability Lab Security Advisory < 20180314-0 > === title: Arbitrary Shortcode Execution & Local File Inclusion product: WOOF - WooCommerce Products Filter (PluginUs.Net)

[FD] SEC Consult SA-20180423-0 :: Multiple Stored XSS Vulnerabilities in WSO2 Carbon and Dashboard Server

SEC Consult Vulnerability Lab Security Advisory < 20180423-0 > === title: Multiple Stored XSS Vulnerabilities product: WSO2 Carbon, WSO2 Dashboard Server vulnerable version: WSO2 Identity Server

[FD] SEC Consult SA-20180424-0 :: Reflected Cross-Site Scripting in multiple Zyxel ZyWALL products

SEC Consult Vulnerability Lab Security Advisory < 20180424-0 > === title: Reflected Cross-Site Scripting product: Zyxel ZyWALL: see "Vulnerable / tested version" vulnerable version: ZLD

[FD] SEC Consult SA-20180227-0 :: OS command injection, arbitrary file upload & SQL injection in ClipBucket

SEC Consult Vulnerability Lab Security Advisory < 20180227-0 > === title: OS command injection, arbitrary file upload & SQL injection product: ClipBucket vulnerable version: <4.0.0 -

[FD] SEC Consult SA-20180228-0 :: Insecure Direct Object Reference vulnerability in TestLink Open Source Test Management

SEC Consult Vulnerability Lab Security Advisory < 20180228-0 > === title: Insecure Direct Object Reference product: TestLink Open Source Test Management vulnerable version: <1.9.17 fixe

[FD] SEC Consult SA-20181009-0 :: Remote Code Execution via XMeye P2P Cloud in Xiongmai IP Cameras, NVRs and DVRs incl. 3rd party OEM devices (CVE-2018-17915, CVE-2018-17917, CVE-2018-17919)

SEC Consult also published a blog post regarding the identified security issues with further background information: Blog: https://r.sec-consult.com/xmeye SEC Consult Vulnerability Lab Security Advisory < 2018100

[FD] SEC Consult SA-20181001-0 :: Password disclosure vulnerability & XSS in PTC ThingWorx (CVE-2018-17216, CVE-2018-17217, CVE-2018-17218)

SEC Consult Vulnerability Lab Security Advisory < 20181001-0 > === title: Password disclosure vulnerability & XSS product: PTC ThingWorx vulnerable version: 6.5-7.4, 8.0.x, 8.1.x, 8.2.x

[FD] SEC Consult SA-20180926-0 ::

SEC Consult Vulnerability Lab Security Advisory < 20180926-0 > === title: Stored Cross-Site Scripting product: Progress Kendo UI Editor vulnerable version: v2018.1.221 fixed version: non

[FD] SEC Consult SA-20180924-0 :: Multiple Vulnerabilities in Citrix StorageZones Controller

SEC Consult Vulnerability Lab Security Advisory < 20180924-0 > === title: Multiple Vulnerabilities product: Citrix StorageZones Controller vulnerable version: all versions before 5.4.2

[FD] SEC Consult SA-20181205-0 :: Inadequate cryptography implementation in Kerio Control VPN protocol

SEC Consult Vulnerability Lab Security Advisory < 20181205-0 > === title: Inadequate cryptography implementation product: Kerio Control VPN protocol vulnerable version: <=9.2.7 fixed versi

[FD] SEC Consult SA-20181130-0 :: Multiple Vulnerabilities in Siglent Technologies SDS 1202X-E Digital Oscilloscope

SEC Consult Vulnerability Lab Security Advisory < 20181130-0 > === title: Multiple Vulnerabilities product: Siglent Technologies SDS 1202X-E Digital Oscilloscope vulnerable version: V5.1.3.13

[FD] SEC Consult SA-20181116-0 :: Multiple critical vulnerabilities in Miss Marple Enterprise Edition

SEC Consult Vulnerability Lab Security Advisory < 20181116-0 > === title: Multiple critical vulnerabilities product: Miss Marple Enterprise Edition vulnerable version: <2.0 fixed ver

[FD] SEC Consult SA-20190109-0 :: Multiple Vulnerabilities in Cisco VoIP Phones (88xx series)

SEC Consult Vulnerability Lab Security Advisory < 20190109-0 > === title: Multiple Vulnerabilities product: Cisco VoIP Phones, e.g. models 88XX vulnerable version: See list of vulnerable d

[FD] SEC Consult SA-20180918-0 :: Remote Code Execution via PHP unserialize in Moodle open-source learning platform

SEC Consult Vulnerability Lab Security Advisory < 20180918-0 > === title: Remote Code Execution via PHP unserialize product: Moodle - Open-source learning platform vulnerable version: 3.5 to 3.5.

[FD] SEC Consult SA-20190124-0 :: Cross-site scripting in CA Automic Workload Automation Web Interface (AWI)

SEC Consult Vulnerability Lab Security Advisory < 20190124-0 > === title: Cross-site scripting product: CA Automic Workload Automation Web Interface (AWI) (formerly Automic Auto

[FD] SEC Consult SA-20190205-0 :: Multiple vulnerabilities in OSCI-Transport Library 1.2 for German e-Government

A blog post with further information has been released on this topic as well: https://r.sec-consult.com/osci SEC Consult Vulnerability Lab Security Advisory < 20190205-0 > === title: Multiple vulnerabi

[FD] SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series

SEC Consult Vulnerability Lab Security Advisory < 20190612-0 > === title: Multiple vulnerabilities product: WAGO 852 Industrial Managed Switch Series vulnerable version: 852-303: https://www.wa

[FD] SEC Consult SA-20190509-0 :: Multiple Vulnerabilities in Gemalto (Thales Group) DS3 Authentication Server / Ezio Server

SEC Consult Vulnerability Lab Security Advisory < 20190509-0 > === title: Multiple Vulnerabilities product: Gemalto (Thales Group) DS3 Authentication Server / Ezio Server vuln

[FD] SEC Consult SA-20190513-0 :: Cleartext message spoofing in supplementary Go Cryptography Libraries (@sec_consult)

SEC Consult Vulnerability Lab Security Advisory < 20190513-0 > === title: Cleartext message spoofing product: Supplementary Go Cryptography Libraries vulnerable version:

[FD] SEC Consult SA-20190515-0 :: Authorization Bypass in RSA NetWitness (@sec_consult)

SEC Consult Vulnerability Lab Security Advisory < 20190515-0 > === title: Authorization Bypass product: RSA NetWitness vulnerable version: <10.6.6.1, <11.2.1.1 fixed version: 10.6.6

[FD] SEC Consult SA-20190510-0 :: Unauthenticated SQL Injection vulnerability in OpenProject

SEC Consult Vulnerability Lab Security Advisory < 20190510-0 > === title: Unauthenticated SQL Injection vulnerability product: OpenProject vulnerable version: 5.0.0 - 8.3.1 fixed version:

[FD] SEC Consult SA-20190822-0 :: Multiple Vulnerabilities in OpenPGP.js

SEC Consult Vulnerability Lab Security Advisory < 20190822-0 > === title: Multiple Vulnerabilities product: OpenPGP.js vulnerable version: <=4.2.0 fixed version: 4.3.0 CVE number:

[FD] SEC Consult SA-20190829-0 :: Hardcoded FTP Credentials in Zyxel NWA/NAP/WAC wireless access point series

SEC Consult Vulnerability Lab Security Advisory < 20190829-0 > === title: Hardcoded FTP Credentials product: Zyxel NWA/NAP/WAC wireless access point series vulnerable version: see "Vulnerab

[FD] SEC Consult SA-20190829-1 :: External DNS Requests in Zyxel USG/UAG/ATP/VPN/NXC series

SEC Consult Vulnerability Lab Security Advisory < 20190829-1 > === title: External DNS Requests product: Zyxel USG/UAG/ATP/VPN/NXC series vulnerable version: see "Vulnerable / tested version&q

[FD] SEC Consult SA-20190821-0 :: Unauthenticated sensitive information leakage in Zoho Corporation ManageEngine ServiceDesk Plus

SEC Consult Vulnerability Lab Security Advisory < 20190821-0 > === title: Unauthenticated sensitive information leakage product: Zoho Corporation ManageEngine ServiceDesk Plus vulnerable versio

[FD] SEC Consult SA-20190918-0 :: Reflected Cross-Site Scripting (XSS) in Oracle Mojarra JSF

SEC Consult Vulnerability Lab Security Advisory < 20190918-0 > === title: Reflected Cross-Site Scripting (XSS) product: Oracle Mojarra JSF included in Java EE 7 Eclipse Mojar

[FD] SEC Consult SA-20190926-0 :: Multiple SQL Injection vulnerabilities in eBrigade

SEC Consult Vulnerability Lab Security Advisory < 20190926-0 > === title: Multiple SQL Injection vulnerabilities product: eBrigade vulnerable version: <5.0 fixed version: >=5.0

[FD] SEC Consult SA-20191029-0 :: Authentication Bypass in eIDAS-Node (European #eGovernment cross-border authentication)

SEC Consult Vulnerability Lab Security Advisory < 20191029-0 > === title: Authentication Bypass product: eIDAS-Node vulnerable version: <=v2.3 (v2.1 vulnerability #2) fixed versio

[FD] SEC Consult SA-20191203-0 :: Multiple vulnerabilites in Fronius Solar Inverter Series

SEC Consult Vulnerability Lab Security Advisory < 20191203-0 > === title: Multiple vulnerabilites product: Fronius Solar Inverter Series vulnerable version: SW Version <3.14.1 (HM 1.12.1)

[FD] SEC Consult SA-20191211-0 :: File Extension Spoofing in Windows Defender Antivirus

SEC Consult Vulnerability Lab Security Advisory < 20191211-0 > === title: File Extension Spoofing product: Windows Defender Antivirus vulnerable version: 4.18.1908.7-0 fixed version:

Re: [FD] SEC Consult SA-20191125-0 :: FortiGuard XOR Encryption in Multiple Fortinet Products

Vulnerability Lab On 25.11.19 14:43, SEC Consult Vulnerability Lab wrote: > SEC Consult Vulnerability Lab Security Advisory < 20191125-0 > > === > title: FortiGuard XOR Encryption > product:

[FD] SEC Consult SA-20191202-0 :: Multiple Critical Vulnerabilities in SALTO ProAccess SPACE

SEC Consult Vulnerability Lab Security Advisory < 20191202-0 > === title: Multiple Critical Vulnerabilities product: SALTO ProAccess SPACE vulnerable version: <= v5.5 fixed version

[FD] SEC Consult SA-20191125-0 :: FortiGuard XOR Encryption in Multiple Fortinet Products

SEC Consult Vulnerability Lab Security Advisory < 20191125-0 > === title: FortiGuard XOR Encryption product: Multiple Fortinet Products (see Vulnerable / tested versions) vulnerable version: Mu

[FD] SEC Consult SA-20191014-0 :: Reflected XSS vulnerability in OpenProject

SEC Consult Vulnerability Lab Security Advisory < 20191014-0 > === title: Reflected XSS vulnerability product: OpenProject vulnerable version: <= 9.0.3, <=10.0.1 fixed version: 9

[FD] SEC Consult SA-20200225-0 :: Multiple Cross-site Scripting (XSS) Vulnerabilities in PHP-Fusion CMS

SEC Consult Vulnerability Lab Security Advisory < 20200225-0 > === title: Multiple Cross-site Scripting (XSS) Vulnerabilities product: PHP-Fusion CMS vulnerable version: 9 - 9.03 fixed v

[FD] SEC Consult SA-20200123-0 :: Cross-Site Request Forgery (CSRF) in Umbraco CMS

SEC Consult Vulnerability Lab Security Advisory < 20200123-0 > === title: Cross-Site Request Forgery (CSRF) product: Umbraco CMS vulnerable version: version 8.2.2 fixed version: versi

[FD] SEC Consult SA-20200122-0 :: Reflected XSS in ZOHO ManageEngine ServiceDeskPlus

SEC Consult Vulnerability Lab Security Advisory < 20200122-0 > === title: Reflected XSS product: ZOHO ManageEngine ServiceDeskPlus vulnerable version: <= 11.0 Build 11007 fixed version: 1

[FD] SEC Consult SA-20200407-0 :: Multiple XSS vulnerabilities in TAO Open Source Assessment Platform

SEC Consult Vulnerability Lab Security Advisory < 20200407-0 > === title: Multiple XSS vulnerabilities product: TAO Open Source Assessment Platform vulnerable version: 3.3.0 RC2 fixed v

[FD] SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client

SEC Consult Vulnerability Lab Security Advisory < 20200312-0 > === title: Authenticated Command Injection product: Phoenix Contact TC Router & TC Cloud Client vulnerable version: <=2.05.

[FD] SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client

SEC Consult Vulnerability Lab Security Advisory < 20200312-0 > === title: Authenticated Command Injection product: Phoenix Contact TC Router & TC Cloud Client vulnerable version: <=2.05.

[FD] SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W

SEC Consult Vulnerability Lab Security Advisory < 20200902-0 > === title: Multiple Vulnerabilities product: Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W vulnerable version: <=2.0.26

[FD] SEC Consult SA-20201012-0 :: Reflected Cross-Site Scripting and Unauthenticated Malicious File Upload in Sage DPW

SEC Consult Vulnerability Lab Security Advisory < 20201012-0 > === title: Reflected Cross-Site Scripting and Unauthenticated Malicious File Upload product: Sage DPW vuln

[FD] SEC Consult SA-20201008-0 :: Multiple Cross-Site Scripting Vulnerabilities in Confluence Marketplace Plugins

SEC Consult Vulnerability Lab Security Advisory < 20201008-0 > === title: Multiple Cross-Site Scripting Vulnerabilities products: PlantUML, Refined Toolkit for Confluence, Linking for Conf

[FD] SEC Consult SA-20201005-0 :: Multiple Critical Vulnerabilities in RocketLinx Series

SEC Consult Vulnerability Lab Security Advisory < 20201005-0 > === title: Multiple Critical Vulnerabilities product: RocketLinx Series vulnerable version: See "Vulnerable / tested versions&q

[FD] SEC Consult SA-20200826-0 :: Extensive file permissions on service executable in Eikon Thomson Reuters

SEC Consult Vulnerability Lab Security Advisory < 20200826-0 > === title: Extensive file permissions on service executable product: Eikon Thomson Reuters vulnerable version: 4.0.42144 fixed v

[FD] SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S

SEC Consult Vulnerability Lab Security Advisory < 20200827-0 > === title: Multiple Vulnerabilities product: ZTE mobile Hotspot MS910S vulnerable version: DL_MF910S_CN_EUV1.00.01 fixed v

[FD] SEC Consult SA-20201002-0 :: Multiple Vulnerabilities in SevOne Network Management System (NMS)

SEC Consult Vulnerability Lab Security Advisory < 20201002-0 > === title: Multiple Vulnerabilities product: SevOne Network Management System (NMS) vulnerable version: 5.7.2.22 fixed v

[FD] SEC Consult SA-20201001-0 :: Broken Access Control in Platinum Mobile

SEC Consult Vulnerability Lab Security Advisory < 20201001-0 > === title: Broken Access Control product: Platinum Mobile vulnerable version: 1.0.4.850 fixed version: 1.0.4.851 CVE

[FD] SEC Consult SA-20201023-0 :: Multiple Vulnerabilities in PubliXone

SEC Consult Vulnerability Lab Security Advisory < 20201023-0 > === title: PubliXone - Multiple Vulnerabilities product: konzept-ix publiXone vulnerable version: 2019.045 fixed version: 20

[FD] SEC Consult SA-20200728-0 :: Stored Cross-Site Scripting (XSS) Vulnerability in Namirial SIGNificant SignAnyWhere

SEC Consult Vulnerability Lab Security Advisory < 20200728-0 > === title: Stored Cross-Site Scripting (XSS) Vulnerability product: Namirial SIGNificant SignAnyWhere vulnerable version: v6.10.60

[FD] SEC Consult SA-20200807-0 :: Multiple Vulnerabilities in flatCore CMS

SEC Consult Vulnerability Lab Security Advisory < 20200807-0 > === title: Multiple Vulnerabilities product: flatCore CMS vulnerable version: <=1.5.5 fixed version: 1.5.7 C

[FD] SEC Consult SA-20200701-0 :: Reflected Cross-Site Scripting (XSS) in EQDKP Plus CMS

SEC Consult Vulnerability Lab Security Advisory < 20200701-0 > === title: Reflected Cross-Site Scripting (XSS) Vulnerability product: EQDKP Plus CMS vulnerable version: <= 2.3.29 fixe

[FD] SEC Consult SA-20200708-0 :: Multiple Critical Vulnerabilities in Multiple Rittal Products Based on Same Software

SEC Consult Vulnerability Lab Security Advisory < 20200708-0 > === title: Multiple Critical Vulnerabilities product: Multiple Rittal Products based on same software, e.g. CMC

[FD] SEC Consult SA-20200724-0 :: Privilege Escalation Vulnerability in SteelCentral Aternity Agent

SEC Consult Vulnerability Lab Security Advisory < 20200724-0 > === title: Privilege Escalation Vulnerability product: SteelCentral Aternity Agent vulnerable version: 11.0.0.120 fixed v

[FD] SEC Consult SA-20200717-0 :: Multiple Vulnerabilities in WonderCMS

SEC Consult Vulnerability Lab Security Advisory < 20200717-0 > === title: Multiple Vulnerabilities product: WonderCMS vulnerable version: <=3.1.0 fixed version: - C

[FD] SEC Consult SA-20201123-0 :: Multiple Vulnerabilities in ZTE WLAN router MF253V

SEC Consult Vulnerability Lab Security Advisory < 20201123-0 > === title: Multiple Vulnerabilities product: ZTE WLAN router MF253V vulnerable version: V1.0.0B04 fixed version: V1.

[FD] SEC Consult SA-20201217-0 :: Multiple critical vulnerabilities in Trend Micro InterScan Web Security Virtual Appliance (IWSVA)

SEC Consult Vulnerability Lab Security Advisory < 20201217-0 > === title: Multiple critical vulnerabilities product: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) vulnerable v

[FD] SEC Consult SA-20201117-0 :: Blind Out-Of-Band XML External Entity Injection in Avaya Web License Manager

SEC Consult Vulnerability Lab Security Advisory < 20201117-0 > === title: Blind Out-Of-Band XML External Entity Injection (Authenticated) product: Avaya Web License Manager vulnerable version: 6.

[FD] SEC Consult SA-20201104-0 :: Multiple vulnerabilities in Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)

SEC Consult Vulnerability Lab Security Advisory < 20201104-0 > === title: Multiple Vulnerabilities product: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) vulnerable version: &

[FD] SEC Consult SA-20210113-1 :: Multiple vulnerabilities in flatCore CMS

SEC Consult Vulnerability Lab Security Advisory < 20210113-1 > === title: Multiple Vulnerabilities product: flatCore CMS vulnerable version: < 2.0.0 Build 139 fixed version: Release 2.0.0

[FD] SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series

SEC Consult Vulnerability Lab Security Advisory < 20210113-0 > === title: Multiple vulnerabilities product: Pepperl+Fuchs IO-Link Master Series See "Vulnerable / test

[FD] SEC Consult SA-20210511-0 :: Cross-site Scripting Vulnerabilities in REWE GO

SEC Consult Vulnerability Lab Security Advisory < 20210511-0 > === title: Reflected Cross-site Scripting Vulnerabilities product: SIS Informatik - REWE GO vulnerable version: 7.5.0/12C

[FD] SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series

SEC Consult Vulnerability Lab Security Advisory < 20210601-0 > === title: Multiple Critical Vulnerabilities product: Multiple Korenix Technology products: Korenix: JetNet 5428G

<    1   2   3   4   5   6   7   >