CVE-2019-1830: Improper Input Validation

A vulnerability in Locally Significant Certificate LSC management for the Cisco Wireless LAN Controller WLC could allow an authenticated, remote attacker to cause the device to unexpectedly restart, which causes a denial of service DoS condition. The attacker would need to have valid administrato...

CVE-2019-3943

MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files...

CVE-2019-3943

CVE-2019-3943 affects MikroTik RouterOS: authenticated remote directory traversal via HTTP or Winbox. Vulnerable on Stable 6.43.12 and earlier, Long-term 6.42.12 and earlier, and Testing 6.44beta75 and earlier. The issue allows reading/writing files outside the sandbox directory (/rw/disk). Conne...

CVE-2019-3906: Use of Hard-coded Credentials

Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents...

CVE-2018-14623: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-15713: Improper Neutralization of Input During Web Page Generation

Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...

CVE-2018-0284: Undefined Security Weakness

A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local status page. An exploit could allow the...

CVE-2018-15405: Improper Authorization

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly...

CVE-2018-0427: Improper Neutralization of Special Elements used in a Command

A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to incorrect input validation of user-supplied data. An attacker could exploit this...

CVE-2018-0350: Improper Neutralization of Special Elements used in a Command

A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...

PT-2018-8733

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software affected versions not specified Description: A vulnerability in role-based access control RBAC for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should be restricted for a...

PT-2018-8908

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.5.0 through 4.6.1 Description The issue allows remote authenticated attackers to bypass access restrictions, enabling them to view the closed title of "Cabinet" through unspecified vectors. Recommendations For Cybozu...

CVE-2017-11509: Improper Neutralization of Special Elements used in an SQL Command

An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement...

CVE-2017-17169: Improper Input Validation

The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. An authenticated remote attacker could send a malicious message to a target system. Successful exploit could allow the...

CVE-2017-17168: Improper Input Validation

The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. An authenticated remote attacker could send a malicious message to a target system. Successful exploit could allow the...

PT-2018-6477

Name of the Vulnerable Software and Affected Versions: Huawei DP300 versions V500R002C00 through V500R002C00SPCa00 Huawei RP200 version V500R002C00SPC200 Huawei TE30 versions V100R001C10 through V100R001C10SPC900 Huawei TE30 versions V500R002C00SPC200 through V500R002C00SPCb00 Huawei TE40 version...

CVE-2017-1731: Undefined Security Weakness

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges...

CVE-2018-0099: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of GUI command arguments. An attacker could exploit this...

CVE-2017-15051: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the 1 URL value of an item or 2 user log history. To exploit the vulnerability, the attacker must be first authenticated to the...

CVE-2017-8133: Improper Neutralization of Special Elements used in a Command

Huawei iManager NetEco with software V600R008C00 and V600R008C10 has a command injection vulnerability. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a...