Meross MSS110 Unauthenticated Admin .HTM Management Interface Vulnerability

Meross MSS110 is a smart WiFi socket device from China's Forari Meross Technology. A security vulnerability exists in Meross MSS110 version 1.1.24 and earlier. An attacker can exploit this vulnerability to cause a denial of service or obtain information...

CVE-2018-10166

The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fix...

CVE-2018-10166: Cross-Site Request Forgery (CSRF)

The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fix...

PT-2018-9728

Name of the Vulnerable Software and Affected Versions: TP-Link EAP Controller and Omada Controller versions 2.5.4 Windows through 2.6.0 Windows Description: The web management interface lacks Anti-CSRF tokens in forms, allowing an attacker to submit authenticated requests when an authenticated us...

CVE-2017-2832

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in...

Command injection

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in...

CVE-2017-2832

Summary : CVE-2017-2832 affects the Foscam C1 Indoor HD Camera via the CGIProxy.fcgi Account Deletion Command Injection vulnerability. The attacker must have an administrator account to exploit. During delAccount, the code path extracts usrName and passes it to a function that ultimately executes...

CVE-2017-2833

The vulnerability CVE-2017-2833 affects the Foscam C1 Indoor HD Camera (firmware 2.52.2.37). During boot, the webService startup config builds an FTP command line using user-supplied credentials without sanitization, and then invokes system(). If an administrative account is compromised, an attac...

CVE-2017-2832

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in...

PT-2018-7202

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera version 2.52.2.37 Description: A command injection issue exists in the web management interface of the affected device. It allows an attacker to inject arbitrary shell characters through a specially crafted HTTP...

PT-2018-7201

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera version 2.52.2.37 Description: A command injection issue exists in the web management interface of the affected device. It allows an attacker to inject arbitrary shell characters during a password change, resulting ...

CVE-2017-2833: Improper Neutralization of Special Elements used in a Command

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the...

CVE-2018-0259

A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the...

CVE-2018-0259

The CVE-2018-0259 issue affects Cisco MATE Collector’s web-based management interface, arising from inadequate CSRF protections. An unauthenticated, remote attacker could induce a logged-in user to click a malicious link, enabling the attacker to perform arbitrary actions on the device via the us...

CVE-2018-7920

Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the...

CVE-2018-0259: Cross-Site Request Forgery (CSRF)

A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the...

Huawei Denial of Service Vulnerability in Multiple AR Series Products

The AR1200, AR160, and AR3200 are a series of enterprise routers from China's Huawei. A denial of service vulnerability exists in several of Huawei's AR series products. Due to improper implementation of the ACL mechanism, a remote attacker can send a TCP request to the management interface, and ...

PT-2018-8706

Name of the Vulnerable Software and Affected Versions: Cisco MATE Collector affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary...

Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability

A vulnerability in the Login screen of the Clientless SSL VPN WebVPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Th...

Cisco MATE Collector Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the...