Security Vulnerabilities - CVEs Published In January 2018
The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.
CVSS Score
8.8
EPSS Score
0.001
Published
2018-01-11
Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash) or (2) ..\ (dot dot forward slash) before a file name.
CVSS Score
7.5
EPSS Score
0.008
Published
2018-01-11
Symmetricom s350i 2.70.15 allows remote authenticated users to gain privileges via vectors related to pushing unauthenticated users to the login page.
CVSS Score
8.8
EPSS Score
0.006
Published
2018-01-11
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file.
CVSS Score
7.2
EPSS Score
0.011
Published
2018-01-11
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the pptp_client.lua file.
CVSS Score
7.2
EPSS Score
0.014
Published
2018-01-11
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_client.lua file.
CVSS Score
7.2
EPSS Score
0.014
Published
2018-01-11
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the phddns.lua file.
CVSS Score
7.2
EPSS Score
0.014
Published
2018-01-11
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the interface_wan.lua file.
CVSS Score
7.2
EPSS Score
0.014
Published
2018-01-11
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_client.lua file.
CVSS Score
7.2
EPSS Score
0.014
Published
2018-01-11
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_client.lua file.
CVSS Score
7.2
EPSS Score
0.014
Published
2018-01-11