OTRS Ticket Request Administration XSS

The vulnerability of the OTRS ticket request administration interface is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

WatchGuard XTM Firebox Unauthenticated Remote Command Execution

This module exploits a buffer overflow at the administration interface 8080 or 4117 of WatchGuard Firebox and XTM appliances which is built from a cherrypy python backend sending XML-RPC requests to a C binary called wgagent using pre-authentication endpoint /agent/login. This vulnerability impac...

CVE-2021-37289

Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etcro/web/syscmd.asp...

Command injection

Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etcro/web/syscmd.asp...

PT-2022-15964

Name of the Vulnerable Software and Affected Versions Softing Secure Integration Server version V1.22 Description The issue allows for authentication bypass via a machine-in-the-middle attack. The administration interface is accessible via plaintext HTTP protocol by default, which facilitates the...

PT-2022-19915 · Raytion · Raytion Custom Security Manager

Name of the Vulnerable Software and Affected Versions: Raytion Custom Security Manager version 7.2.0 Description: The administration interface of the Raytion Custom Security Manager allows reflected Cross-site Scripting XSS. This issue can be exploited through the administration interface,...

CVE-2022-29931: Improper Neutralization of Input During Web Page Generation

The administration interface of the Raytion Custom Security Manager Raytion CSM in Version 7.2.0 allows reflected Cross-site Scripting XSS...

PT-2022-2515

Name of the Vulnerable Software and Affected Versions Zyxel USG FLEX 100W versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 200 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 500 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 700 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 50W version...

CVE-2022-29906

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66 omits a check for the quizadmin user...

QNAP QTS / QuTS Hero Default Credentials

The remote QNAP QTS or QuTS Hero web administration interface uses a known set of hard-coded default credentials. An attacker can exploit this to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

VMware Carbon Black App Control Code Execution

The vulnerability of the administration interface of the VMware Carbon Black App Control server relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by loading a specially crafted file...

Unspecified Vulnerability in 3CX Phone System

The 3CX Phone is a software-based private branch exchange. It can be used with SIP standard based IP phones, SIP trunks and VoIP gateways to provide a complete communication solution. A security vulnerability exists in the 3CX Phone System that stems from the 3CX Phone System storing passwords in...

Reflected cross-site scripting (XSS) vulnerability

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package. Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init...

GHSA-HRGX-7J6V-XJ82 Reflected cross-site scripting (XSS) vulnerability

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package. Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init...

PT-2022-1901

Name of the Vulnerable Software and Affected Versions VMware Carbon Black App Control versions 8.5.x prior to 8.5.14 VMware Carbon Black App Control versions 8.6.x prior to 8.6.6 VMware Carbon Black App Control versions 8.7.x prior to 8.7.4 VMware Carbon Black App Control versions 8.8.x prior to...

PT-2022-1902

Name of the Vulnerable Software and Affected Versions VMware Carbon Black App Control versions 8.5.x prior to 8.5.14 VMware Carbon Black App Control versions 8.6.x prior to 8.6.6 VMware Carbon Black App Control versions 8.7.x prior to 8.7.4 VMware Carbon Black App Control versions 8.8.x prior to...

EC-CUBE improper access control vulnerability

EC-CUBE is an open source system for creating shopping websites. EC-CUBE version 2.11.2 - 2.17.1 contains an improper access control vulnerability in the administration interface. An attacker could use this vulnerability to change system settings without proper privileges...

PT-2021-19929 · Contour +1 · Contour +1

Name of the Vulnerable Software and Affected Versions: Contour versions prior to 1.17.1 Contour versions prior to 1.18.0 Description: A specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy containe...

PT-2021-19880 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.4.1.1 Description: The admin API has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommended to update to version 6.4.1.1. The update to 6.4.1.1 can ...

CVE-2021-23896

Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security DBSec prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to...