9723 matches found
Command injection
A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a wa...
PT-2019-17577
Name of the Vulnerable Software and Affected Versions ArubaOS versions 8.x Description A command injection issue is present in the web management interface of ArubaOS, allowing an authenticated user to execute arbitrary commands on the underlying operating system. This could enable a malicious...
CVE-2019-5315: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a wa...
Cisco Data Center Network Manager Information Disclosure Vulnerability
An information disclosure vulnerability exists in the web-based management interface of Cisco Data Center Network Manager DCNM due to improper access controls for certain URLs on affected DCNM software. An unauthenticated, remote attacker can exploit this, by connecting to the web-based managemen...
CVE-2019-12644 Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability exists...
CVE-2019-12644: Improper Neutralization of Input During Web Page Generation
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability exists...
CVE-2019-6647
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory o...
Design/Logic Flaw
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory o...
CVE-2019-6647
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory o...
PT-2019-18229
Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.2 through 11.6.4 F5 BIG-IP versions 12.1.0 through 12.1.4.1 F5 BIG-IP versions 13.0.0 through 13.1.2 F5 BIG-IP versions 14.0.0 through 14.0.0.4 F5 BIG-IP versions 14.1.0 through 14.1.0.5 Description The issue is related...
PT-2019-3227
Name of the Vulnerable Software and Affected Versions Cisco Industrial Network Director IND affected versions not specified Description A vulnerability in the "plug-and-play" services component of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to access sensitiv...
CVE-2019-6647: Missing Release of Memory after Effective Lifetime
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory o...
PT-2019-3310
Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE Software affected versions not specified Description A vulnerability in the web-based management interface exists due to insufficient validation of user-supplied input. This could allow an unauthenticated,...
Cisco RV110W/RV130(W)/RV215W Routers Management Interface - Remote Command Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework linux/armle/meterpreter/bindtcp - segfault linux/armle/meterpreter/reversetcp - segfault linux/armle/meterpreterreversehttp - works linux/armle/meterpreterreversehttps -...
CommScope ARRIS TR4400 Authentication Bypass Vulnerability
The CommScope ARRIS TR4400 is a wireless router from CommScope, Inc. An authentication bypass vulnerability exists in the CommScope ARRIS TR4400 using firmware version A1.00.004-180301 and earlier, which originates from http://192.168.1.1/login.html中包含了使用base64编码的当前密码. An attacker could exploit t...
Cisco RV110W / RV130(W) / RV215W Remote Command Execution Exploit
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The...
The vulnerability in the web interface for managing Cisco Enterprise NFV Infrastructure Software (NFVIS) allows a attacker to gain limited access to the web interface for management purposes.
The vulnerability of the Cisco Enterprise NFV Infrastructure Software’s software infrastructure management web interface is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain limited access to the management web interface...
Cross-site Scripting (XSS)
opencms-core is vulnerable to cross-site scripting XSS attack. The sanitization of input parameters are not done properly in system/workplace/ , allowing multiple XSS attacks in the management interface...
Local File Inclusion (LFI)
opencms-core is vulnerable to local file inclusion LFI vulnerability. It is possible because server resources such as: clearhistory.jsp, convertxml.jsp, groupnew.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp are accessible by the attacker...