CVSS: 9.8EPSS: 6%CPEs: 6EXPL: 0CVE-2019-12585
https://notcve.org/view.php?id=CVE-2019-12585
03 Jun 2019 — Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. Apcupsd versión 0.3.91_5, como de costumbre en pfSense hasta versión 2.4.4-RELEASE-p3 y otros productos, tiene un problema de ejecución de comandos arbitrarios en el archivo apcupsd_status.ph • https://ctrsec.io/index.php/2019/05/28/cve-2019-12584-12585-command-injection-vulnerability-on-pfsense-2-4-4-release-p3 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 2%CPEs: 6EXPL: 0CVE-2019-12584
https://notcve.org/view.php?id=CVE-2019-12584
03 Jun 2019 — Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. Apcupsd versión 0.3.91_5, como es usado en pfSense hasta versión 2.4.4-RELEASE-p3 y otros productos, tiene un problema de tipo Cross-Site Scripting (XSS) en el archivo apcupsd_status.php. • https://ctrsec.io/index.php/2019/05/28/cve-2019-12584-12585-command-injection-vulnerability-on-pfsense-2-4-4-release-p3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7884 – APC UPS Daemon 3.14.14 Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-7884
16 Jun 2017 — In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe. En Demonio APC UPS hasta versión 3.14.14 de Adam Kropelin adk0212 , la instala... • https://packetstorm.news/files/id/142977 • CWE-427: Uncontrolled Search Path Element •
CVSS: 10.0EPSS: 6%CPEs: 4EXPL: 0CVE-2003-0098
https://notcve.org/view.php?id=CVE-2003-0098
26 Feb 2003 — Unknown vulnerability in apcupsd before 3.8.6, and 3.10.x before 3.10.5, allows remote attackers to gain root privileges, possibly via format strings in a request to a slave server. Vulnerabilidad desconocida en apcupsd anteriores a 3.8.6, y 3.10.x anteriores a 3.10.5 permite a atacantes remotos ganar privilegios de root, posiblemente mediante cadenas de formato en una petición a un servidor esclavo. • ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-015.0.txt •