PT-2019-14399

Name of the Vulnerable Software and Affected Versions CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 Description The issue allows for an authentication bypass to the administrative interface. This is possible because the current base64 encoded password is included within th...

CVE-2017-8230

On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security analysis it was identified that a low privileged user who belongs to the "user" group and who has access to login in to the web administrativ...

CVE-2019-7394

A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where a...

CVE-2019-7394

Technical details about CVE-2019-7394 are not publicly provided in the supplied documents. Monitor for updates from NVD/CA notices for affected versions, vulnerable components, and fixes.

CVE-2019-3915

Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway G1100 firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface...

Authentication flaw

Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway G1100 firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface...

Netgate pfSense Command Injection (CVE-2018-4021)

A command injection vulnerability exists in the administrative interface of Netgate pfSense. The vulnerability is due to improper sanitization of three parameters in requests sent to system. Successful exploitation results in the execution of arbitrary commands as the root user on the target serv...

DELL EMC OneFS Storage Administration 8.1.2.0 .zshrc Overwrite Exploit

!/usr/bin/env python Exploit name : isilon-onefs-brute.py Created date : 9/21/18 Submit Date : 10/10/18 Author : wetw0rk Python version : 2.7 Brute Force Script:...

Hardcoded credentials

A vulnerability in the install function of Cisco Prime Collaboration Provisioning PCP could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. The vulnerability is due to a hard-coded...

Cross site request forgery (csrf)

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

CVE-2018-7060

CVE-2018-7060 concerns Aruba ClearPass CSRF on authenticated users. Connected sources (NVD/CNVD) confirm: affected products are Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1. The vulnerability enables CSRF attacks that could cause an authenticated user to perform actions on the we...

CVE-2018-7060: Cross-Site Request Forgery (CSRF)

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

PT-2018-17878

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions 6.6.x prior to 6.6.9 Aruba ClearPass versions 6.7.x prior to 6.7.1 Description The issue allows for CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions o...

GHSA-FWR5-Q9RX-294F Improper query string handling in Django

The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series...

Improper query string handling in Django

The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series...

CVE-2018-6678

Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway MWG MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors...

CVE-2018-6677

Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway MWG MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges via unspecified vectors...

Design/Logic Flaw

Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway MWG MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors...

CVE-2018-6678 McAfee Web Gateway (MWG) - Configuration/Environment manipulation vulnerability

Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway MWG MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors...

CVE-2018-6678

CVE-2018-6678 affects McAfee Web Gateway (MWG) 7.8.1.x. The vulnerability exists in the administrative interface and allows authenticated administrator users to execute arbitrary commands via unspecified vectors (configuration/environment manipulation). Connected documents consistently describe M...