SEC Consult Vulnerability Lab

8 exploits Active since Sep 2017
CVE-2015-4684 EXPLOITDB MEDIUM text WRITEUP
Polycom RealPresence Resource Manager < 8.3.2 - Authenticated Directory Traversal and Arbitrary File Upload
Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitrary files via a .. (dot dot) in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary files via the (2) Filename or (3) SE_FNAME parameter to PlcmRmWeb/FileUpload or to read and remove arbitrary files via the (4) filePathName parameter in an importSipUriReservations SOAP request to PlcmRmWeb/JUserManager.
CVSS 6.5
CVE-2015-4683 EXPLOITDB CRITICAL text WRITEUP
Polycom RealPresence Resource Manager < 8.3.2 - Session ID Info Disclosure & Privilege Escalation
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests.
CVSS 9.8
CVE-2015-4682 EXPLOITDB MEDIUM text WRITEUP
Polycom RealPresence Resource Manager < 8.3.2 - Authenticated Installation Path Exposure via JConfigManager
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmRmWeb/JConfigManager.
CVSS 6.5
CVE-2015-4681 EXPLOITDB HIGH text WRITEUP
Polycom RealPresence Resource Manager < 8.3.2 - Unspecified Impact via Weak Passwords
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords.
CVSS 7.8
CVE-2023-28770 METASPLOIT HIGH ruby WORKING POC
Zyxel DX5401-B0 <V5.17(ABYO.1)C0 - Info Disclosure
The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file.
CVSS 7.5
CVE-2015-4685 EXPLOITDB HIGH text WRITEUP
Polycom RealPresence Resource Manager < 8.3.2 - Privilege Escalation via Sudo Misconfiguration
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration.
CVSS 7.0
EIP-2026-102016 EXPLOITDB text WORKING POC
Solare Datensysteme Solar-Log Devices 2.8.4-56/3.5.2-85 - Multiple Vulnerabilities
EIP-2026-102015 EXPLOITDB text WORKING POC
Solare Datensysteme Solar-Log Devices 2.8.4-56/3.5.2-85 - Multiple Vulnerabilities