CVE-2018-10079
published 2018-04-20CVE-2018-10079: Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users to modify configuration data by…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
0.78%
51.4th percentile
Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users to modify configuration data by updating (1) config.xml or (2) servers.xml.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vertiv | watchdog_console | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities
exploitdb·2019-03-15·CVSS 6.1
CVE-2014-10079 [MEDIUM] Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities
Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities
---
# Exploit Title: Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities
# Discovery Date: 2018-12-05
# Exploit Author: Gionathan "John" Reale
# Vendor Homepage: https://www.vembu.com/
# Software Link : N/A
# Google Dork: N/A
# Version: 4.4.0
# CVE : CVE-2014-10078,CVE-2014-10079
Description StoreGrid enables you to offer an automated online backup service to your customers and is designed to be flexible to your needs. Upon investigating the web interface I discovered multiple vulnerabilities.
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Information Disclosure. The front page of the server web interface leaks the private IP address
Exploit-DB
Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
exploitdb·2018-04-18·CVSS 4.9
CVE-2018-10079 [MEDIUM] Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
---
# Exploit Author: bzyo
# CVE: CVE-2018-10077, CVE-2018-10078, CVE-2018-10079
# Twitter: @bzyo_
# Exploit Title: Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
# Date: 04-17-18
# Vulnerable Software: WatchDog Console - 3.2.2
# Vendor Homepage: http://www.itwatchdogs.com/
# Version: 3.2.2
# Software Link: http://www.itwatchdogs.com/userfiles/file/firmware/Console/WatchDogConsoleInstaller_v3.2.2.exe
# Tested On: Windows 7 x86
Description
WatchDog Console suffers from multiple vulnerabilities:
# CVE-2018-10077 Authenticated XML External Entity (XXE)
# CVE-2018-10078 Authenticated Stored Cross Site Scripting (XSS)
# CVE-2018-10079 Insecure File Permissions
Prerequisites
To successfully exploit these vulnerabilities, an at
No writeups or analysis indexed.
http://packetstormsecurity.com/files/147253/Geist-WatchDog-Console-3.2.2-XSS-XML-Injection-Insecure-Permissions.htmlhttps://www.exploit-db.com/exploits/44493/http://packetstormsecurity.com/files/147253/Geist-WatchDog-Console-3.2.2-XSS-XML-Injection-Insecure-Permissions.htmlhttps://www.exploit-db.com/exploits/44493/
2018-04-20
Published