Vulnerabilidades

An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which FortiClientEMSOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.

The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). NOTE: testing inside an RF-isolated shield box suggested that all LTE phones are…

IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for Waternamics V5.1.0 - V5.2.1.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user…

IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.

IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162737.

Linear eMerge E3-Series devices allow Privilege Escalation.

Linear eMerge E3-Series devices allow Unrestricted File Upload.

Linear eMerge E3-Series devices allow Command Injections.

Linear eMerge E3-Series devices allow XSS.

Linear eMerge E3-Series devices allow File Inclusion.

Linear eMerge E3-Series devices allow Directory Traversal.

Linear eMerge E3-Series devices have Default Credentials.

Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).

Linear eMerge E3-Series devices have Hard-coded Credentials.

Linear eMerge E3-Series devices have Cleartext Credentials in a Database.

Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.

Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).

Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.

Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.

Linear eMerge 50P/5000P devices allow Cookie Path Traversal.

Linear eMerge 50P/5000P devices allow Authentication Bypass.

Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).

Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.

Linear eMerge E3-Series devices have a Version Control Failure.

Nortek Linear eMerge 50P/5000P devices have Default Credentials.