CVE-2021-23845

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

The vulnerability of the “Startup Configuration” page of the asynchronous replication extension for VMware vSphere Replication allows a attacker to execute arbitrary code.

The vulnerability of the “Startup Configuration” page of the VMware vSphere Replication asynchronous replication extension is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2020-26733

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

CVE-2020-26733

Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section...

CVE-2020-26733

CVE-2020-26733: XSS in the Configuration page of SKYWORTH GN542VF (HW 2.0 / SW 2.0.0.16). The vulnerability resides in the DDNS Configuration section, allowing an authenticated attacker to inject script via that page. Documented impact is Cross Site Scripting with partial integrity impact and low...

Skyworth Gn542vf Cross-Site Scripting Vulnerability

The Skyworth Gn542vf is an Internet TV device from Skyworth, a Chinese company. The Skyworth Gn542vf Hardware Version 2.0 and Software Version 2.0.0.16 suffers from a cross-site scripting vulnerability that can be exploited by an authenticated attacker to inject their own scripts into a page via...

CVE-2020-35611

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values...

Unauthorized access vulnerability in NC601B web configuration page of Anhui Kanghai Times Technology Co.

NC601B is a serial port server from Anhui Kanghai Times Technology Co. Ltd. An unauthorized access vulnerability exists in the NC601B web configuration page. An attacker can exploit this vulnerability to obtain critical information about the system, resulting in the disclosure of sensitive...

PT-2020-15483 · Cloudbees +1 · Jenkins Health Advisor By Cloudbees Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Health Advisor by CloudBees Plugin versions 3.2.0 and earlier Description: The issue arises from an incorrect permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view the endpoint, which includes a...

Rukovoditel Cross-Site Scripting Vulnerability

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A cross-site scripting vulnerability exists in the configuration page in Rukovoditel version 2.5.2. The...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Cross site scripting

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

CVE-2020-11813

CVE-2020-11813: In Rukovoditel 2.5.2, a stored XSS exists on the configuration page via the copyright text input, causing injected scripts to potentially steal user data since the copyright text appears on every page. The vulnerability is triggered by unsanitized input in a client-side field; doc...

CVE-2020-8423

A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 firmware version 3.16.9 devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

Design/Logic Flaw

Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page...

Design/Logic Flaw

In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call...

CVE-2019-14525

The CVE-2019-14525 affects Octopus Deploy versions 2019.4.0–2019.6.x before 2019.6.6 and 2019.7.x before 2019.7.6, where an authenticated system administrator can view sensitive values via a server configuration page or API call. Root cause: insufficient access control on configuration data expos...

Cross site scripting

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page...

CVE-2019-6324

HP Color LaserJet Pro M280-M281 Multifunction Printer series (before 20190419) and HP LaserJet Pro MFP M28-M31 Printer series (before 20190426) are affected by a stored XSS in the wireless configuration page due to insufficient input validation on the embedded web server. This could allow an atta...