devolo dLAN 550 duo+ version 3.1.0-1 suffers from a remote code execution vulnerability. The devolo firmware has what seems to be a 'hidden' services which can be enabled by authenticated attacker via the the htmlmgr CGI script. This allows the attacker to start services that are deprecated or discontinued and achieve remote arbitrary code execution with root privileges.
7ece4c01e8a0626b1675f616f6834eda99a5d6c9df3da5ad87248e5df5a38acbdevolo dLAN 550 duo+ version 3.1.0-1 allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. The devolo web application uses predictable URL/form actions in a repeatable way. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
ef85c57f56409245d558b8ef33c2fd67c217b4996cab0cd01b97e45870edf390devolo dLAN Cockpit version 4.3.1 suffers from an unquoted service path privilege escalation vulnerability.
e2ba777c979d93db830ef17b9d5e3b9022f0a6e9f57d0584c41dbda1e007db65X5 Webserver version 5.0 suffers from a null pointer dereference denial of service vulnerability.
20e86a4799ce0f3a93471b800f54e6319f7f2f9543076dd201a6ac354599f983This document contains the results of a second comparative penetration test conducted by a team of security specialists at Zero Science Lab against two cloud-based Web Application Firewall (WAF) solutions: Incapsula and Cloudflare. This test was designed to bypass security controls in place, in any possible way, circumventing whatever filters they have. Given the rise in application-level attacks, the goal of the test was to provide IT managers of online businesses with a comparison of these WAFs against real-world threats in simulated real-world conditions.
049e90fe97f45591ee478a6bbbd1000e75975f5dbc47b2e1e89cfc59d6426fdcThis document contains the results of a comparative penetration test conducted by a team of security specialists at Zero Science Lab against three 'leading' web application firewall solutions. The goal of the authors was to bypass security controls in place, in any way we can, circumventing whatever filters they have. This report also outlines the setup and configuration process, as well as a detailed security assessment.
b7ec360c41751b864d585550e59e6ce9daffa5990a1e4421486df42ffc283b61
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed