CVE-2024-1509 Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100

Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks...

The vulnerability of the web interface of Netgear C7800 router software allows a attacker to execute a type of “man-in-the-middle” attack.

The vulnerability of the web interface of Netgear C7800 router software lies in the deficiencies in the authentication process. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” type attack...

The vulnerability in the web interfaces of software solutions that support the closing, consolidation, and reporting processes of IBM Cognos Controller and IBM Controller allows attackers to carry out cross-site scripting attacks and gain unauthorized access to protected information.

The vulnerability of web interfaces of software solutions that support closing, consolidation, and reporting processes for IBM Cognos Controller and IBM Controller is related to insufficient protection of the web page structure. Exploiting this vulnerability allows an attacker to perform cross-si...

The vulnerability of the user interface of Windows operating systems allows a hacker to hide files that have been decompiled from a specially created archive from users’ sight.

The vulnerability of Windows operating systems’ user interfaces is related to the improper handling of file attributes. Exploiting this vulnerability can allow attackers to hide files that have been decompressed from a specially crafted archive from users’ sight...

CVE-2025-20211 Cisco BroadWorks Application Delivery Platform Software Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management interface do...

Dell Avamar Access Token Reuse Vulnerability

Dell Avamar is a data backup and recovery solution from Dell that focuses on providing organizations with efficient and flexible data protection services that support physical, virtual and cloud environments. Dell Avamar suffers from an access token reuse vulnerability that stems from the inclusi...

The vulnerability of the software interface of FortiWeb web applications allows a perpetrator to execute arbitrary commands or code.

The vulnerability of the software interface of FortiWeb web applications exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or code by sending specially crafted requests...

CVE-2024-8893

Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi.This issue affects GW1500‑XS: 1.1.2.1...

CVE-2024-8893

The CVE-2024-8893 issue affects GoodWe GW1500‑XS (firmware version 1.1.2.1). The root cause is hard‑coded credentials, enabling anyone in physical proximity to access the inverter’s web interface over Wi‑Fi. Evidence from PT-2025-6771 and CNNVD-202502-1681, Red Hat, NVD, and CVE records consisten...

CVE-2023-4203

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface...

The vulnerability of the application software interface of the Active Directory Domain Services service on the Windows operating system, which allows a perpetrator to cause a service failure

The vulnerability of the application programming interface of the Active Directory Domain Services service on the Windows operating system is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2025-26408

CVE-2025-26408 affects Wattsense Bridge devices where the JTAG interface is unprotected and accessible via physical access to the PCB, granting full device access (extract/modify firmware) across all known versions. Root cause per SEC Consult/PacketStorm analysis is an unprotected JTAG interface ...

The vulnerability in the web-based interface for managing software for network deployment and security management in HPE Aruba Networking Fabric Composer allows attackers to execute cross-site scripting attacks.

The vulnerability in the web-based interface for managing software for network deployment and security management in HPE Aruba Networking Fabric Composer is related to the lack of protective measures for the web page structure. Exploiting this vulnerability could allow a malicious actor to carry...

CVE-2024-43779

An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to reading vaults that have been previously disabled, possibly leaking sensitive credentials. An attacker can send a series of HTTP...

CVE-2022-43439

A vulnerability has been identified in POWER METER SICAM Q100 7KG9501-0AA01-0AA1 All versions V2.50, POWER METER SICAM Q100 7KG9501-0AA01-2AA1 All versions V2.50, POWER METER SICAM Q100 7KG9501-0AA31-0AA1 All versions V2.50, POWER METER SICAM Q100 7KG9501-0AA31-2AA1 All versions V2.50, SICAM P850...

The vulnerability in the web interface of the microprogramming software for routing and switching platforms RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, and RUGGEDCOM ROX RX1400 allows a attacker to perform a CSRF attack.

The vulnerability of the web interface of microprogramming software for routing and switching platforms such as RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, and RUGGEDCOM ROX RX1400 is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a remote attacker to...

CVE-2022-20951

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery SSRF attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

CVE-2024-29836

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site...

CVE-2024-20393

A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability exists because the web-based management interfa...

Cisco Identity Services Engine 跨站脚本漏洞

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be use...