Security Vulnerabilities - CVEs Published In February 2018
A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF.
CVSS Score
6.1
EPSS Score
0.081
Published
2018-02-20
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS.
CVSS Score
8.8
EPSS Score
0.027
Published
2018-02-20
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
CVSS Score
7.2
EPSS Score
0.021
Published
2018-02-20
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
CVSS Score
4.8
EPSS Score
0.002
Published
2018-02-20
Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
CVSS Score
9.8
EPSS Score
0.02
Published
2018-02-20
Datto ALTO and SIRIS devices have a default VNC password.
CVSS Score
9.8
EPSS Score
0.004
Published
2018-02-20
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.
CVSS Score
5.3
EPSS Score
0.002
Published
2018-02-20
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
CVSS Score
5.3
EPSS Score
0.002
Published
2018-02-20
The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensitive cleartext information via an "adb backup '-f smart.calculator.gallerylock'" command.
CVSS Score
7.5
EPSS Score
0.003
Published
2018-02-20
smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for Android allows attackers to access files via the backdoor 17621762 PIN.
CVSS Score
7.5
EPSS Score
0.003
Published
2018-02-20