Cisco IOS and IOS XE Cross-Site Scripting Vulnerability

Cisco IOS and IOS XE are a set of operating systems developed by Cisco for its network devices. A cross-site scripting vulnerability exists in the web framework code in Cisco IOS and Cisco IOS XE, which stems from a program that fails to perform sufficient input validation. A remote attacker coul...

The vulnerability in the web interface of the Cisco Integrated Management Controller, a software tool for remote administration of servers, allows a malicious individual to make unauthorized changes to the system configuration.

The vulnerability of the web interface for managing Cisco Integrated Management Controllers involves authentication errors. Exploiting this vulnerability allows an attacker to make unauthorized changes to the system configuration remotely...

CVE-2019-12624

A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller NGWC could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to...

RUSTSEC-2019-0014 Flaw in interface may drop uninitialized instance of arbitrary types

Affected versions of this crate would call Vec::setlen on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances. This could run Drop implementations on...

CVE-2019-9585

eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.Metadata related operations, resulting in the ability to read, set and deletion of Metadata...

Edimax Wi-Fi Extender Cross-Site Request Forgery Vulnerability

Edimax Technology Wi-Fi Extender is a wireless signal extender from Edimax Technology of Taiwan, China. A cross-site request forgery vulnerability exists in the Edimax Wi-Fi Extender device. The vulnerability stems from a WEB application that does not adequately validate that a request is coming...

CVE-2019-1946

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementatio...

Design/Logic Flaw

A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security TLS...

PT-2019-13721 · 3Proxy +1 · 3Proxy +1

Name of the Vulnerable Software and Affected Versions: 3proxy versions prior to 0.8.13 Description: The issue is related to an out-of-bounds write in the admin interface of the webadmin.c component. Recommendations: For versions prior to 0.8.13, update to version 0.8.13 or later to resolve the...

CVE-2019-14390

cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface SEC-512...

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

A flaw was found in the Linux kernel's implementation of IPMI remote baseband access. An attacker, with local access to read /proc/ioports, may be able to create a use-after-free condition when the kernel module is unloaded which may result in privilege escalation...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to compromise the integrity of protected information.

The vulnerability of the Cisco Identity Services Engine ISE web interface is related to input validation errors. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

Cisco Vision Dynamic Signage Director Authorization Issues Vulnerability

Cisco Vision Dynamic Signage Director is an end-to-end dynamic signage and IPTV solution from Cisco USA. An authorization issue vulnerability exists in the REST API interface in Cisco Vision Dynamic Signage Director, which stems from the program failing to adequately validate HTTP requests. A...

CVE-2019-1943

A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attack...

The vulnerability of the web interface of Cisco Small Business router microprogramming software models 200, 300, and 500 allows a hacker to cause a service failure.

The vulnerability of the web interface of Cisco Small Business router microprogramming software models 200, 300, and 500 exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by sending a speciall...

The vulnerability in the web interface of Cisco Firepower Management Center’s network management software allows a perpetrator to execute arbitrary code or gain access to confidential information.

The vulnerability in the web interface of Cisco Firepower Management Center’s network management software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or gain access to confidential...

The vulnerability in the web interface of Cisco Firepower Management Center’s network management software allows a perpetrator to execute arbitrary code or gain access to confidential information.

The vulnerability in the web interface of Cisco Firepower Management Center’s network management software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or gain access to confidential...

Moxa OnCell G3470A-LTE Memory Corruption Vulnerability (CNVD-2019-23546)

The Moxa OnCell G3470A-LTE is a G3470A-LTE series cellular network gateway device from Moxa Taiwan, China. A memory corruption vulnerability exists in the web interface of the Moxa OnCell G3470A-LTE 1.6 Build 18021314 and earlier versions. An attacker can exploit the vulnerability to corrupt memo...

The vulnerability of D-Link DI-524 router’s microprogramming software lies in the lack of protective measures for the website structure, allowing attackers to inject arbitrary JavaScript code into the device’s web interface pages.

The vulnerability of D-Link DI-524 router’s microprogram code exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject JavaScript code into the device’s web interface pages. The web configuration files,...

CVE-2019-6622

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems...