The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and network device management system, as well as the Cisco Evolved Programmable Network Manager software, allows a malicious actor to execute arbitrary SQL queries.

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network Manager software relates to input validation errors. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries by sending specially...

TP-LINK TL-WR840N v5 XSS Injection Vulnerability

The TP-Link TL-WR840N is a wireless router from China P&L TP-Link. A cross-site scripting vulnerability exists in TP-LINK TL-WR840N v5 00000005 using firmware version 0.9.1 3.16 v0001.0 Build 171211 Rel.58800n. The vulnerability stems from the lack of proper validation of client data by the WEB...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones series 8800 allows a perpetrator to cause a service failure.

The vulnerability of the web interface of Cisco IP phones—IP Phone 8800, IP Conference Phone 8832, IP Phone 8821, and IP Phone 8821-EX—is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones series 8800 allows a perpetrator to write arbitrary files into the device’s file system.

The vulnerability of the web interface of Cisco IP phones—IP Phone 8800, IP Conference Phone 8832, IP Phone 8821, and IP Phone 8821-EX—is related to deficiencies in path name checking for access-controlled directories. Exploiting this vulnerability allows a malicious actor to write arbitrary file...

CVE-2019-4045

IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241...

VulnCheck KEV: CVE-2019-1663

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The...

The vulnerability of the software tool’s web interface for creating Cisco Unified Intelligence Center reports allows a malicious actor to send arbitrary requests to the vulnerable system via a web browser with user privileges.

The vulnerability of the software interface for creating reports in Cisco Unified Intelligence Center exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to send arbitrary requests to the vulnerable system via a web...

The vulnerability in the web interface of the operating system PAN-OS allows a hacker to inject any desired JavaScript or HTML code into the web page that is being uploaded.

The vulnerability of the PAN-OS operating system’s web interface exists due to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code into the loaded web page from a remote location...

The vulnerability of the web interface of Cisco Unified IP Phone 7900 Series software lies in the lack of measures taken to protect the website structure. This allows attackers to inject arbitrary code into the uploaded web pages or disclose protected information.

The vulnerability of the web interface of Cisco Unified IP Phone 7900 Series software lies in the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the loaded web page or disclose protected...

Design/Logic Flaw

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...

The vulnerability of microprogramming software in Cisco RV110W Wireless-N VPN web interfaces and Cisco RV130W Wireless-N and Cisco RV215W Wireless-N VPN multifunctional routers allows attackers to disclose protected information.

The vulnerability of microprogrammed software in Cisco RV110W Wireless-N VPN web management interfaces and Cisco RV130W Wireless-N and Cisco RV215W Wireless-N VPN multifunctional routers stems from insufficient testing of character sequences used in catalog traversal in the web management...

CVE-2018-15424

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server...

CVE-2016-7047

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access...

Design/Logic Flaw

interface/fax/faxdispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter...

SUSE-SU-2018:1016-1 Security update for the Linux Kernel (Live Patch 31 for SLE 12)

This update for the Linux Kernel 3.12.61-52119 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. bsc1085447. - CVE-2018-1068: A flaw was found in the Linux kernels implementation of...

SUSE-SU-2018:1001-1 Security update for the Linux Kernel (Live Patch 27 for SLE 12)

This update for the Linux Kernel 3.12.61-5292 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. bsc1085447. - CVE-2018-1068: A flaw was found in the Linux kernels implementation of...

SUSE-SU-2018:0996-1 Security update for the Linux Kernel (Live Patch 24 for SLE 12)

This update for the Linux Kernel 3.12.61-5283 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. bsc1085447. - CVE-2018-1068: A flaw was found in the Linux kernels implementation of...

SUSE-SU-2018:1006-1 Security update for the Linux Kernel (Live Patch 23 for SLE 12)

This update for the Linux Kernel 3.12.61-5280 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. bsc1085447. - CVE-2018-1068: A flaw was found in the Linux kernels implementation of...

SUSE-SU-2018:1010-1 Security update for the Linux Kernel (Live Patch 21 for SLE 12)

This update for the Linux Kernel 3.12.61-5272 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. bsc1085447. - CVE-2018-1068: A flaw was found in the Linux kernels implementation of...

SUSE-SU-2018:0995-1 Security update for the Linux Kernel (Live Patch 28 for SLE 12)

This update for the Linux Kernel 3.12.61-52101 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. bsc1085447. - CVE-2018-1068: A flaw was found in the Linux kernels implementation of...