CVE-2020-11813: Improper Neutralization of Input During Web Page Generation

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

CVE-2020-8423

A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 firmware version 3.16.9 devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

CVE-2019-15304: Initialization of a Resource with an Insecure Default

Lierda Grill Temperature Monitor V1.0050006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page located on the device. This wifi thermometer app requests and...

Design/Logic Flaw

Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page...

Design/Logic Flaw

In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call...

CVE-2019-14525

The CVE-2019-14525 affects Octopus Deploy versions 2019.4.0–2019.6.x before 2019.6.6 and 2019.7.x before 2019.7.6, where an authenticated system administrator can view sensitive values via a server configuration page or API call. Root cause: insufficient access control on configuration data expos...

PT-2019-13732

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2019.4.0 through 2019.6.x before 2019.6.6 Octopus Deploy versions 2019.7.x before 2019.7.6 Description An authenticated system administrator can view sensitive values by visiting a server configuration page or making an...

CVE-2019-14525: Undefined Security Weakness

In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call...

Cross site scripting

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page...

CVE-2019-6324

HP Color LaserJet Pro M280-M281 Multifunction Printer series (before 20190419) and HP LaserJet Pro MFP M28-M31 Printer series (before 20190426) are affected by a stored XSS in the wireless configuration page due to insufficient input validation on the embedded web server. This could allow an atta...

CVE-2019-6324

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page...

CVE-2019-6323: Improper Neutralization of Input During Web Page Generation

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page...

CVE-2019-6324: Improper Neutralization of Input During Web Page Generation

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page...

PT-2019-2854

Name of the Vulnerable Software and Affected Versions HP Color LaserJet Pro M280-M281 Multifunction Printer series versions before 20190419 HP LaserJet Pro MFP M28-M31 Printer series versions before 20190426 Description The issue exists due to inadequate protection of the web page structure in th...

PT-2019-2855

Name of the Vulnerable Software and Affected Versions HP Color LaserJet Pro M280-M281 Multifunction Printer series versions before 20190419 HP LaserJet Pro MFP M28-M31 Printer series versions before 20190426 Description The issue is related to an embedded web server in the printers, which may be...

CVE-2019-11350: Insufficiently Protected Credentials

CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page...

PT-2019-12251

Name of the Vulnerable Software and Affected Versions CloudBees Jenkins Operations Center version 2.150.2.3 Description The issue allows cleartext password storage and retrieval via the proxy configuration page when an expired trial license exists. Recommendations For CloudBees Jenkins Operations...

Cross site scripting

In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting XSS attack...

qdPM 9.1 - type Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications =========================================================================================== Exploit Title: qdPM 9.1 - 'type' XSS Injection CVE: CVE-2019-8391. Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...