CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19014
https://notcve.org/view.php?id=CVE-2019-19014
An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, including mv, chown, and chmod. This can be trivially exploited to gain root privileges by an attacker with access. Se detectó un problema en TitanHQ WebTitan versiones anteriores a 5.18. Presenta un archivo de sudoers que permite a usuarios con pocos privilegios ejecutar una gran número de comandos como root, incluidos mv, chown y chmod. • https://write-up.github.io/webtitan https://www.webtitan.com/resources/product-updates • CWE-269: Improper Privilege Management •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-6800
https://notcve.org/view.php?id=CVE-2019-6800
In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject arbitrary commands. En TitanHQ SpamTitan hasta 7.03, existe una vulnerabilidad en la función de actualización de la regla de spam. Las actualizaciones se descargan a través de HTTP, incluidos los scripts que posteriormente se ejecutan con permisos de root. • https://write-up.github.io/CVE-2019-6800 https://www.spamtitan.com/category/spamtitan-news • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15136
https://notcve.org/view.php?id=CVE-2018-15136
TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entire organization by modifying the URL requests sent to the application. TitanHQ SpamTitan, en versiones anteriores a la 7.01, tiene una validación de entradas incorrecta. Esto permite a los atacantes internos omitir el filtro antispam para enviar correos maliciosos a todo el personal de una determinada organización modificando las peticiones URL enviadas a la aplicación. • https://www.fwhibbit.es/bypassing-spam-titan-my-first-cve • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18227
https://notcve.org/view.php?id=CVE-2017-18227
TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature. TitanHQ WebTitan Gateway tiene una validación incorrecta de certificados para la característica de interceptación TLS. • http://dx.doi.org/10.14722/ndss.2017.23456 https://jhalderm.com/pub/papers/interception-ndss17.pdf https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/security-impact-https-interception • CWE-295: Improper Certificate Validation •