Unauthenticated Action

SSD Advisory – Ruckus IoT vRIoT Server Vulnerabilities

Leave a Comment / Vulnerability publication / By

Vulnerability SummaryThe Ruckus IoT Suite is a collection of network hardware and software infrastructure used to enable multi-standard Internet of Things devices access the network. The IoT Controller, part of the IoT Suite, is a virtual controller that performs connectivity, device and security management for non Wi-Fi devices.Many functionalities are exposed by the IoT Controller …

SSD Advisory – Ruckus IoT vRIoT Server Vulnerabilities Read More »

SSD Advisory – GetSimple CMS Unauthenticated Remote Code Execution

1 Comment / Vulnerability publication / By

Vulnerabilities SummaryThe following advisory describes a vulnerability in GetSimple CMS which allows unauthenticated attackers to perform Remote Code Execution.CVECVE-2019-11231CreditAn independent Security Researcher, truerand0m, has reported this vulnerability to SSD Secure Disclosure program.Affected systemsGetSimple CMS version 3.3.15 (Latest at the time of writing this post) and before.Vendor ResponseWe have notified the vendor on the 21/1/2019 and …

SSD Advisory – GetSimple CMS Unauthenticated Remote Code Execution Read More »

SSD Advisory – Cisco Prime Infrastructure File Inclusion and Remote Command Execution to Privileges Escalation

6 Comments / Vulnerability publication / By

Vulnerabilities Summary Cisco Prime Infrastructure (CPI) contains two vulnerabilities that when exploited allow an unauthenticated attacker to achieve root privileges and execute code remotely. The first vulnerability is a file upload vulnerability that allows the attacker to upload and execute JSP files as the Apache Tomcat user. The second vulnerability is a privilege escalation to …

SSD Advisory – Cisco Prime Infrastructure File Inclusion and Remote Command Execution to Privileges Escalation Read More »

SSD Advisory – CloudByte ElastiStor OS Unauthenticated Remote Code Execution

1 Comment / Vulnerability publication / By

Vulnerabilities Summary The following advisory describes two vulnerabilities found in ElastiCenter, ElastiStor’s management console, File Injection that leads to unauthenticated remote code execution. ElastiCenter is the centralized management tool that you use to configure, monitor, manage, and deploy the services provided by CloudByte ElastiStor. ElastiCenter lets you: Use the Graphical User Interface to manage the …

SSD Advisory – CloudByte ElastiStor OS Unauthenticated Remote Code Execution Read More »

SSD Advisory – QRadar Remote Command Execution

4 Comments / Vulnerability publication / By

Vulnerability Summary Multiple vulnerabilities in QRadar allow a remote unauthenticated attackers to cause the product to execute arbitrary commands. Each vulnerability on its own is not as strong as their chaining – which allows a user to change from unauthenticated to authenticated access, to running commands, and finally running these commands with root privileges. Vendor …

SSD Advisory – QRadar Remote Command Execution Read More »

SSD Advisory – TrustPort Management Unauthenticated Remote Code Execution

1 Comment / Vulnerability publication / By

Vulnerability Summary Multiple vulnerabilities in TrustPort’s management product allow remote unauthenticated attackers to cause the product to execute arbitrary code. TrustPort Management “offers you an effective and practical way to install centrally, configure and update antivirus software in your network and it enables mass administration of TrustPort products. Central administration from TrustPort brings you simple …

SSD Advisory – TrustPort Management Unauthenticated Remote Code Execution Read More »

SSD Advisory – TerraMaster TOS Unauthenticated Remote Command Execution

1 Comment / Vulnerability publication / By

Vulnerability Summary The following advisory describes a unauthenticated remote command execution found in TerraMaster TOS 3.0.33. TOS is a “Linux platform-based operating system developed for TerraMaster cloud storage NAS server. TOS 3 is the third generation operating system newly launched.” Credit An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure …

SSD Advisory – TerraMaster TOS Unauthenticated Remote Command Execution Read More »

SSD Advisory – Vigor ACS Unsafe Flex AMF Java Object Deserialization

1 Comment / Vulnerability publication / By

Vulnerability Summary A vulnerability in Vigor ACS allows unauthenticated users to cause the product to execute arbitrary code. VigorACS 2 “is a powerful centralized management software for Vigor Routers and VigorAPs, it is an integrated solution for configuring, monitoring, and maintenance of multiple Vigor devices from a single portal. VigorACS 2 is based on TR-069 …

SSD Advisory – Vigor ACS Unsafe Flex AMF Java Object Deserialization Read More »

SSD Advisory – AppWeb Authentication Bypass (Digest, and Basic)

1 Comment / Vulnerability publication / By

Vulnerability Summary A critical vulnerability in the EmbedThis HTTP library, and Appweb versions 5.5.x, 6.x, and 7.x including the latest version present in the git repository. In detail, due to a logic flaw, with a forged HTTP request it is possible to bypass the authentication for HTTP basic and HTTP digest login types. Confirmed Vulnerable …

SSD Advisory – AppWeb Authentication Bypass (Digest, and Basic) Read More »

SSD Advisory – VK Messenger (VKontakte) vk:// URI Handler Commands Execution

1 Comment / Vulnerability publication / By

Vulnerability Summary The following describes a vulnerability in VK Messenger that is triggered via the exploitation of improperly handled URI. VK (VKontakte; [..], meaning InContact) is “an online social media and social networking service. It is available in several languages. VK allows users to message each other publicly or privately, to create groups, public pages …

SSD Advisory – VK Messenger (VKontakte) vk:// URI Handler Commands Execution Read More »

SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure

2 Comments / Vulnerability publication / By

Vulnerability Summary The following advisory describes an information disclosure found in the following TrendNet routers: TEW-751DR – v1.03B03 TEW-752DRU – v1.03B01 TEW733GR – v1.03B01 TRENDnet’s “N600 Dual Band Wireless Router, model TEW-751DR, offers proven concurrent Dual Band 300 Mbps Wireless N networking. Embedded GREENnet technology reduces power consumption by up to 50%. For your convenience …

SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure Read More »

SSD Advisory – CloudMe Unauthenticated Remote Buffer Overflow

2 Comments / Vulnerability publication / By

The following advisory describes one (1) vulnerability found in CloudMe. CloudMe is “a file storage service operated by CloudMe AB that offers cloud storage, file synchronization and client software. It features a blue folder that appears on all devices with the same content, all files are synchronized between devices.” The vulnerability found is a buffer …

SSD Advisory – CloudMe Unauthenticated Remote Buffer Overflow Read More »

Get in touch

Any questions? Interested in our services? 

We’d love to hear from you

Contact US
Facebook Twitter Youtube Linkedin

?

HOME
THE
COMMUNITY
SCOPE
ADVISORIES
SUBMIT
CONTACT

?

Get in touch