CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-2878 – Hawkeye-G 3.0.1.4912 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2015-2878
23 Oct 2017 — Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching, (3) DNS Inject, or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist. Múltiples vulne... • https://www.exploit-db.com/exploits/37686 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2017-14615
https://notcve.org/view.php?id=CVE-2017-14615
20 Sep 2017 — An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Traffic Monitor" sections "Events" and "All." As a side effect, no further events will be visible in the Traffic Monitor until the device is restarted. Se ha desc... • http://seclists.org/bugtraq/2017/Sep/22 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-14616
https://notcve.org/view.php?id=CVE-2017-14616
20 Sep 2017 — An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login attempts, UI management of the device becomes impossible. Se ha descubierto un problema FBX-5312 en WatchGuard Fireware en versiones anteriores a la 12.0. Si se intenta iniciar sesión en la interfaz XML-RPC con un men... • http://www.securityfocus.com/archive/1/540427 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8060
https://notcve.org/view.php?id=CVE-2017-8060
05 May 2017 — Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call. La aceptación de certificados TLS no válidos/autofirmados en "Panda Mobile Security" 1.1 para iOS permite a un atacante mediante ataque man-in-the-middle y/o que se encuentre físicamente cercano, interceptar de forma silenciosa la información enviada durante la llamada a la API de inicio de ... • http://www.securityfocus.com/bid/98327 • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-8339
https://notcve.org/view.php?id=CVE-2017-8339
30 Apr 2017 — PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver. PSKMAD.sys en Panda Free Antivirus 18.0 permite a los usuarios locales causar una denegación de servicio (BSoD) a través de una solicitud manipulada de DeviceIoControl a \\.\PSMEMDriver. • http://saptech-erp.com.au/resources/panda_bsod.zip • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 2CVE-2017-8055
https://notcve.org/view.php?id=CVE-2017-8055
22 Apr 2017 — WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this vulnerability to enumerate valid usernames on an affected Firebox. WatchGuard Fireware permite la enumeración de usuarios, por ejemplo, en el controlador de inicio de sesión Firebox XML-RPC. Una solicitud de inicio de sesión ... • http://watchguardsupport.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000KlGSAU • CWE-203: Observable Discrepancy •
CVSS: 5.3EPSS: 16%CPEs: 1EXPL: 3CVE-2017-8056
https://notcve.org/view.php?id=CVE-2017-8056
22 Apr 2017 — WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The Firebox may also experience an overall degradation in performance while the wgagent process recovers. An attacker could continuously send XML-RPC requests tha... • https://github.com/itzexploit/CVE-2017-8056 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2016-7089 – Watchguard Firewalls - 'ESCALATEPLOWMAN' ifconfig Privilege Escalation
https://notcve.org/view.php?id=CVE-2016-7089
24 Aug 2016 — WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN. Accesorios WatchGuard RapidStream permiten a usuarios locales adquirir privilegios y ejecutar comandos arbitrarios a través de un comando manipulación ifconfig también conocido como ESCALATEPLOWMAN. • https://www.exploit-db.com/exploits/40270 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-7378 – Panda Security URL Filtering < 4.3.1.9 - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-7378
07 Apr 2016 — Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe. Panda Security URL Filtering en versiones anteriores a 4.3.1.9 utiliza una ACL débil para el directorio "Panda Security URL Filtering" y archivos instalados, lo que permite a usuarios locales obtener privilegios de SYSTEM modificando Panda_URL_Filteringb.exe. Panda Security URL Filtering ver... • https://www.exploit-db.com/exploits/39670 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-3943 – Panda Endpoint Administration Agent < 7.50.00 - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2016-3943
07 Apr 2016 — Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which allows local users to gain SYSTEM privileges by modifying an executable module. Desbordamiento de buffer en la función AStreamPeekStream en input/stream.c en VideoLAN VLC media player en versiones anteriores a 2.2.0 permite a atacantes remotos provocar una denegación de servicio (caída) a través de un archivo wav ... • https://www.exploit-db.com/exploits/39671 • CWE-276: Incorrect Default Permissions •