6 - 2022 - :: Deepquest ::

>> Gentics CMS 5.36.29 Cross Site Scripting / Deserialization

USER: deepcore // 2022-06-21 // 0 CMT

Gentics CMS version 5.36.29 suffers from persistent cross site scripting and unsafe java deserialization vulnerabilities.

[EXPLOIT]

>> SoftGuard SNMP Network Management Extension HTML Injection / File Download

USER: deepcore // 2022-06-21 // 0 CMT

SoftGuard Web (SGW) versions prior to 5.1.5 suffer from html injection and arbitrary file system access allow for file downloads.

[EXPLOIT]

>> Mitel 6800/6900 Series SIP Phones Backdoor Access

USER: deepcore // 2022-06-21 // 0 CMT

Mitel 6800/6900 Series SIP Phones excluding 6970 and Mitel 6900 Series IP (MiNet) Phones have a flow to spawn a telnet backdoor on the device with a static root password…

[EXPLOIT]

>> Lepin EP-KP001 KP001_V19 Authentication Bypass

USER: deepcore // 2022-06-21 // 0 CMT

When analyzing the USB flash drive Lepin EP-KP001, Matthias Deeg found out that it uses an insecure hardware design which allows an attacker to bypass the password-based user authentication.

[EXPLOIT]

>> Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor

USER: deepcore // 2022-06-21 // 0 CMT

Nexans FTTO GigaSwitch industrial/office switches HW version 5 suffer from having a hardcoded backdoor user and multiple outdated vulnerable software components.