Cross site scripting

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of...

Ubiquiti Inc.: Readonly to Root Privilege Escalation on EdgeSwitch

An authenticated read-only user can execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges. These vulnerabilities were found on EdgeSwitch 1G switch ESWH and EdgeSwitch 10G switch ESGH firmware v1.9.0. The fix for these vulnerabilities were included in the...

The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager system allows a perpetrator to gain unauthorized access to protected information, affect data integrity, or execute arbitrary commands on the underlying operating system.

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to input validation errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information, compromise data integrity, or...

The vulnerability in the web interface of the Cisco Webex Video Mesh software allows a malicious actor to execute arbitrary commands.

The vulnerability of the Cisco Webex Video Mesh software control web interface is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the API interface of the Cisco Smart Software Manager On-Prem administration license management software allows a perpetrator to trigger a service failure.

The vulnerability of the API interface of the Cisco Smart Software Manager On-Prem administration license software exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the SAP UI5 software-based HTTP handler allows attackers to compromise the integrity of protected information.

The vulnerability of the SAP UI5 software application’s HTTP handler is related to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protected information...

The vulnerability of the web interface of the microprogramming software for the Technicolor TC7230 allows a attacker to perform a DNS Rebinding attack.

The vulnerability of the web interface of the microprogramming software for the Technicolor TC7230 router is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to carry out a DNS Rebinding attack remotely...

PT-2020-9990 · Jinan Usr Iot · Usr-Wifi232-S/T/G2/H Low Power Wifi Module

Name of the Vulnerable Software and Affected Versions: Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module version 1.2.2 Description: A cross-site scripting XSS issue in the configuration web interface allows attackers to leak credentials of the Wi-Fi access point and the web interface login...

SQL Injection Vulnerability in Qixing Helpdesk kb***_ca***.aspx Interface

Kaixin HelpdeskHelpdesk is a system for dealing with day-to-day issues that helps IT collect the issues it deals with on a daily basis and generate reports to quantify the work. A SQL injection vulnerability exists in the kbca.aspx interface of Qixing Helpdesk, which can be exploited by attackers...

F5 Networks BIG-IP : TMOS vulnerability (K03126093)

On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practices. CVE-2019-6664 Impact BIG-IP The defaultfirewall rules for the management interface are not reliably reinstalled after first boot. As a result, the...

The vulnerability of the web interface of the Cisco Stealthwatch Enterprise threat detection and analysis system allows a perpetrator to execute a cross-site scripting attack.

The vulnerability of the Cisco Stealthwatch Enterprise threat detection and analysis web interface is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack using a specially crafted...

The vulnerability in the web interface of the Cisco Industrial Network Director software allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Cisco Industrial Network Director software’s web interface is related to the lack of protective measures taken for the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created web...

CVE-2019-13943

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

CVE-2019-13930

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who must be...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Cisco Identity Services Engine ISE network policy management web interface is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by...

The vulnerability of the Cisco Wireless LAN Controller web interface allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco Wireless LAN Controller web interface is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

The vulnerability in the web interface of Cisco Firepower Management Center’s software management interface allows a perpetrator to carry out a cross-site scripting attack or gain unauthorized access to protected information.

The vulnerability of the web interface of Cisco Firepower Management Center FMC software lies in the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks or gain unauthorized access to protected...

Cisco Stealthwatch Enterprise Cross-Site Scripting Vulnerability

Cisco Stealthwatch Enterprise is a set of enterprise network security protection solutions from the U.S. company Cisco Cisco. The product has security event analysis, network segmentation management and data protection features. A cross-site scripting vulnerability exists in the Web management...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CNVD-2020-00295)

Cisco Prime Infrastructure Software is the United States Cisco Cisco company's set of basic network lifecycle management solutions. The product integrates Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS. A cross-site scripting vulnerability exists in the web-bas...

The vulnerability in the web interface of the Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition systems allows a perpetrator to execute arbitrary code or gain access to confidential information.

The vulnerability of the Web interface for Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition exists due to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary...