SEC Consult

94 exploits Active since Dec 2005
CVE-2014-0894 EXPLOITDB text WRITEUP
IBM Algo Credit Limits 4.5.0-4.7.0 - Exposure of Sensitive Information via XML Document
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows context-dependent attackers to discover database credentials by reading the DbUser and DbPass fields in an XML document.
CVE-2018-8716 EXPLOITDB MEDIUM text WRITEUP
WSO2 Identity Server < 5.5.0 - Stored Cross-Site Scripting via Dashboard
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
CVSS 5.4
CVE-2016-1610 EXPLOITDB HIGH text WRITEUP
Novell Filr <1.2 SU3, 2.0 SU2 - Path Traversal
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.
CVSS 7.5
CVE-2018-1247 EXPLOITDB HIGH text WRITEUP
RSA Authentication Manager < 8.3 - XML External Entity Injection via Malicious DTD
RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin users to cause a denial of service or extract server data via injecting a maliciously crafted DTD in an XML file submitted to the application.
CVSS 7.1
CVE-2014-3439 EXPLOITDB text WORKING POC
Symantec Endpoint Protection Manager <12.1 - RCE
ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vectors.
EIP-2026-102536 EXPLOITDB text WRITEUP
Sybase EAServer 6.3.1 - Multiple Vulnerabilities
CVE-2014-9412 EXPLOITDB text WRITEUP
NetIQ Access Manager 4.x < 4.1 - Cross-Site Scripting via Debug Parameters
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216.
EIP-2026-101780 EXPLOITDB text WRITEUP
Huawei E5331 MiFi Mobile Hotspot 21.344.11.00.414 - Multiple Vulnerabilities
EIP-2026-102016 EXPLOITDB text WORKING POC
Solare Datensysteme Solar-Log Devices 2.8.4-56/3.5.2-85 - Multiple Vulnerabilities
EIP-2026-102015 EXPLOITDB text WORKING POC
Solare Datensysteme Solar-Log Devices 2.8.4-56/3.5.2-85 - Multiple Vulnerabilities
EIP-2026-102008 EXPLOITDB text WORKING POC
Skybox Platform < 7.0.611 - Multiple Vulnerabilities
CVE-2015-4685 EXPLOITDB HIGH text WRITEUP
Polycom RealPresence Resource Manager < 8.3.2 - Privilege Escalation via Sudo Misconfiguration
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration.
CVSS 7.0
EIP-2026-101847 EXPLOITDB text WRITEUP
MICROSENS Profi Line Switch 10.3.1 - Privilege Escalation
CVE-2018-13109 EXPLOITDB HIGH text WRITEUP
Adbglobal Dv2210 Firmware - Incorrect Authorization
All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerability where attackers are able to access and manipulate settings within the web interface that are forbidden to end users (e.g., by the ISP). An attacker would be able to enable the TELNET server or other settings as well.
CVSS 7.5
CVE-2018-13108 EXPLOITDB HIGH text WRITEUP
Epicentro - Privilege Escalation
All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerability where attackers are able to gain root access on the device, and extract further information such as sensitive configuration data of the ISP (e.g., VoIP credentials) or attack the internal network of the ISP.
CVSS 7.8
CVE-2018-13110 EXPLOITDB HIGH text WRITEUP
Adbglobal Dv2210 Firmware - Incorrect Permission Assignment
All ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege escalation vulnerability where attackers can gain access to the command line interface (CLI) if previously disabled by the ISP, escalate their privileges, and perform further attacks.
CVSS 7.5
EIP-2026-100843 EXPLOITDB text WRITEUP
Linksys E Series - Multiple Vulnerabilities
EIP-2026-100382 EXPLOITDB text WRITEUP
JSFTemplating / Mojarra Scales / GlassFish - File Disclosure
CVE-2018-7707 EXPLOITDB MEDIUM text WRITEUP
SecurEnvoy SecurMail <9.2.501 - XSS
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message.
CVSS 6.1