CVE-2021-23896: Cleartext Transmission of Sensitive Information

Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security DBSec prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to...

CVE-2021-25644

An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators...

ASUS GT-AC2900 authorization issue vulnerability

ASUS GT-AC2900 is a router from ASUS China.A security vulnerability exists in versions prior to ASUS GT-AC2900 devices 3.0.0.4.386.42643, which allows the administrator application to allow bypass of authentication when handling remote input from unauthenticated users, which could be exploited by...

CVE-2021-32030

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.438446630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handlereques...

Authentication flaw

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handlerequest in router/httpd/httpd.c and authche...

CVE-2021-32030

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.438446630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handlereques...

PT-2020-15878 · Tenda · Tenda Ac18 Router

Name of the Vulnerable Software and Affected Versions: Tenda AC18 Router versions through V15.03.05.05 EN Tenda AC18 Router versions through V15.03.05.196318 CN Description: The issue is related to incorrect authentication handling of the logincheck function in the /usr/lib/lua/ngx authserver/ngx...

Path traversal

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface...

CVE-2020-8222

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting...

PT-2020-20033 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R8 Description: A path traversal issue exists, allowing an authenticated attacker to read arbitrary files via the administrator web interface. Recommendations: For versions prior to 9.1R8, update to...

TRS Haiyun Government Intensive Intelligent Portal Platform suffers from unauthorized access vulnerability

TRS Haiyun Government Intensive Intelligent Portal Platform is a new generation of government intensive intelligent portal platform independently developed by TORS. TRS Haiyun Government Intensive Intelligent Portal Platform has an unauthorized access vulnerability. Attackers can use the...

IBM WebSphere Portal Security Bypass Vulnerability (CVE-2018-1672)

The version of IBM WebSphere Portal installed on the remote Windows host is affected by a security bypass vulnerability due to improper validaiton of user context during impersionation senarios. An authenticated, remote attacker can exploit this, to perform actions in the user or administrator...

Canon PRINT Information Disclosure Vulnerability

Canon PRINT is a mobile application for controlling and managing printers from Canon Japan. A security vulnerability exists in Canon PRINT version 2.5.5, which arises from the program's failure to properly restrict access to data. The vulnerability can be exploited by an attacker with a malicious...

The vulnerability of the page handler /api/cmdb web interface of the FortiOS operating system allows attackers to execute cross-site scripting attacks.

The vulnerability of the page handler /api/cmdb web interface of the FortiOS operating system is related to errors during HTTP request filtering. Exploiting this vulnerability allows a malicious actor to perform cross-site attacks using specially crafted POST requests sent to the /api/cmdb page...

CVE-2019-10973

Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface...

Django Security Bypass Vulnerability (CNVD-2019-21074)

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes object-oriented mapper , view system , template system and so on. A security vulnerability exists in Django that stems from the program's failure to properly handle...

CVE-2019-3602: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML...

CVE-2018-16136

An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the submission of multiple forms unwillingly by a victim...

CVE-2018-16136

An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the submission of multiple forms unwillingly by a victim...

CVE-2018-16136: Cross-Site Request Forgery (CSRF)

An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the submission of multiple forms unwillingly by a victim...