Cisco Wireless LAN Controller Denial of Service Vulnerability (CNVD-2017-05525)

The Cisco WLC is responsible for system-wide wireless LAN functions such as security policy, intrusion protection, RF management, quality of service, and mobility. Cisco Wireless LAN Controller WLC version 8.3.102.0, a security vulnerability exists in the Web management interface. An...

The vulnerability of the Windows operating system allows a perpetrator to obtain confidential information from the process memory, cause a service failure, or have other adverse effects on the system.

The vulnerability of the Graphical Device Interface GDI in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, acting locally, to obtain confidential information from the process’s memory, cause a service failure...

PT-2017-08: Information Exposure in Hirschmann Automation and Control GmbH Classic Platform Switches

The specialists of the Positive Research center have detected an Information Exposure vulnerability in Hirschmann Automation and Control GmbH Classic Platform Switches. An information exposure through query strings vulnerability in the web interface of Belden Hirschmann RS, RSR, RSB, MACH100,...

CVE-2017-6555

Cross-site scripting XSS vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1description parameter aka "Design Manager Categories Category Description"...

CVE-2017-3805

A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential information that is displayed without authenticating to the device. Affected Products: This vulnerability affects Cisco IOS Software and...

OSIsoft PI Web API Account Privilege Vulnerability

OSIsoft is the world's leading provider of real-time performance management software RtPM™ suites. A security issue exists in OSIsoft PI Web API 2015 R2, which can be exploited by unauthenticated attackers to access affected devices...

CVE-2016-2995

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2997, CVE-2016-300...

Fortinet FortiOS 4.1.x < 4.1.11 / 4.2.x < 4.2.13 / 4.3.x < 4.3.9 Web Interface Cookie Parser RCE (EGREGIOUSBLUNDER)

The remote FortiGate device is running a version of FortiOS that is 4.1.x prior to 4.1.11, 4.2.x prior to 4.2.13, or 4.3.x prior to 4.3.9. It is, therefore, affected by a remote code execution vulnerability, known as EGREGIOUSBLUNDER, in the web interface due to improper validation when parsing...

Cisco RV180/RV180W Directory Traversal Vulnerability

The Cisco RV180 and RV180W are wireless multifunction VPN routers. A directory traversal vulnerability exists in the Cisco RV180/RV180W, which stems from the web interface of the RV180 and RV180W not validating and filtering user input for directory paths. An attacker could exploit this...

The vulnerability of the microprogramming software of Cisco RV130W, Cisco RV215W, and Cisco RV110W allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the web interface configuration of microprogramming software for Cisco RV130W, Cisco RV215W, and Cisco RV110W exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or...

[SECURITY] [DLA 544-1] tcpreplay security update

Package : tcpreplay Version : 3.4.3-2+wheezy2 CVE ID : CVE-2016-6160 Debian Bug : 829350 The tcprewrite program, part of the tcpreplay suite, does not check the size of the frames it processes. Huge frames may trigger a segmentation fault, and such frames occur when caputuring packets on interfac...

Systech SysLINK M2M Modular Gateway Command Execution Vulnerability

The Systech SysLINK SL-1000 M2M Machine-to-Machine Modular Gateway is a router product from Systech, Inc. that provides DHCP, NAT, VPN, and firewall features. A command execution vulnerability exists in the web interface of the Systech SysLINK SL-1000 M2M Modular Gateway. A remote attacker can...

The vulnerability of the application interface of IBM WebSphere Portal servers allows a hacker to inject any Web or HTML code.

The vulnerability of the application interface of the IBM WebSphere Portal servers exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially crafted URL...

The vulnerability of the application interface of IBM WebSphere Portal servers allows a hacker to inject any Web or HTML code.

The vulnerability of the application interface of the IBM WebSphere Portal servers exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially crafted URL...

The vulnerability of the application interface of IBM WebSphere Portal servers allows a hacker to inject any Web or HTML code.

The vulnerability of the application interface of the IBM WebSphere Portal server exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...

Digital Paradise Mobile Office Middleware Interface File Traversal Vulnerability

Digital Paradise's MKey3G mobile office middleware is an enterprise-oriented application BYOD middleware platform, which has been widely used in energy, finance, government and enterprises. A file traversal vulnerability in the interface of Digital Paradise's Mobile Office Middleware can be...

The vulnerability of the Cisco Firepower Extensible Operating System allows a hacker to inject any Web or HTML code.

The vulnerability of the Cisco Firepower Extensible Operating System’s web interface exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code by entering special parameters remote...

Cisco Prime Service Catalog Web Interface Unauthorized Access Vulnerability

Cisco Prime Service Catalog provides a self-service portal, service request management, and IT service catalog for the data center. A security vulnerability exists in the web interface of Cisco Prime Service Catalog. A remote attacker could exploit this vulnerability to perform configuration...

ZTE ZXHN H108N R1A webproc cgi module cross-site scripting vulnerability

The ZTE ZXHN H108N R1A is a wireless router product from China's ZTE Corporation. The webproc cgi in the ZTE ZXHN H108N R1A ZTE.bhs.ZXHNH108NR1A.hPE version fails to properly handle the 'errorpage' parameter, which allows remote attackers to exploit the vulnerability to inject malicious script or...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a intruder to bypass the passwords of unauthorized users.

The vulnerability in the web-based administration interface of Cisco TelePresence Video Communication Server software is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor to reset the passwords of arbitrary users remotely...