13029 matches found
CVE-2022-47210
The default console presented to users over telnet when enabled is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
CVE-2022-25627
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4...
Xxe
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...
Command injection
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4...
Session fixation
An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session...
PT-2022-28036 · NetGear · Rax30 Firmware
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The default console presented to users over telnet, when enabled, is restricted to a subset of commands. However, commands issued at this console appear...
PT-2022-17420 · Symantec · Symantec Identity Manager
Name of the Vulnerable Software and Affected Versions: Symantec Identity Manager version 14.4 Description: An authenticated user can perform XML eXternal Entity injection in the Management Console. This issue allows for potential data exposure or other malicious activities. Recommendations: For...
PT-2022-17418 · Unknown · Identity Manager
Name of the Vulnerable Software and Affected Versions: Identity Manager affected versions not specified Description: An unauthenticated user can access specific page URLs of Identity Manager's management console. However, the system does not allow the user to carry out server-side tasks without a...
Symantec Identity Manager 授权问题漏洞
Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager version 14.4, which originates from an unauthenticated user being able to access a specific page URL in the management console, but the system does no...
Symantec Identity Manager 代码问题漏洞
Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager version 14.4, which originates from an authenticated user being able to perform XML external entity injection in the management console...
PT-2022-17419 · Symantec · Symantec Identity Manager
Name of the Vulnerable Software and Affected Versions: Symantec Identity Manager version 14.4 Description: An authenticated administrator with physical access to the environment can execute remote commands on the Management Console. This issue affects the Management Console component...
CVE-2022-25626
An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session...
CVE-2022-47210
The default console presented to users over telnet when enabled is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device...
CVE-2022-25626
CVE-2022-25626 affects Identity Manager. An unauthenticated user can access management-console page URLs, but cannot perform server-side tasks without an active web session. Public data across multiple feeds corroborates access to specific URLs without session establishment; however, no concrete ...
CVE-2022-25626
An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session...
ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup
The plugin does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs. Run the below command in the developer console of the web browser while being on the blog as a subscribe...
NETGEAR Nighthawk 操作系统命令注入漏洞
The NETGEAR Nighthawk WiFi6 Router is a series of routers that support WiFi 6 technology and are designed for users who are looking for a high-speed Internet experience. The NETGEAR Nighthawk WiFi6 Router suffers from a command injection vulnerability that stems from the fact that the default...