CVE-2019-14338: Improper Neutralization of Input During Web Page Generation

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

A flaw was found in the Linux kernel's implementation of IPMI remote baseband access. An attacker, with local access to read /proc/ioports, may be able to create a use-after-free condition when the kernel module is unloaded which may result in privilege escalation...

CVE-2019-12948

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service DoS condition or execute arbitrary co...

CVE-2019-12948

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service DoS condition or execute arbitrary co...

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

A flaw was found in the Linux kernel's implementation of IPMI remote baseband access. An attacker, with local access to read /proc/ioports, may be able to create a use-after-free condition when the kernel module is unloaded which may result in privilege escalation...

CVE-2019-12948

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service DoS condition or execute arbitrary co...

PT-2019-13046

Name of the Vulnerable Software and Affected Versions Polycom UC Software affected versions not specified Description A vulnerability in the web-based management interface of certain Polycom phones could allow an authenticated, remote attacker with admin privileges to cause a denial of service Do...

CVE-2019-12948: Exposed Dangerous Method or Function

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service DoS condition or execute arbitrary co...

Hillstone Firewall StoneOS 5.5R7 Remote Code Execution Vulnerability

Hillstone is dedicated to providing users with comprehensive, smarter, zero-intrusive network security solutions. A remote code execution vulnerability exists in Hillstone Firewall StoneOS 5.5R7. Web management interface that allows attack vectors to be accessed via port 443...

Htek UC902 VoIP phone Buffer Overflow Vulnerability

Htek UC902 VoIP phone is an IP phone from China Hanlong Technology Htek. A buffer overflow vulnerability exists in the web management interface in the Htek UC902 VoIP phone using firmware version 2.0.4.4.46. The vulnerability originates when a network system or product performs operations on memo...

The vulnerability in the web-based management interfaces of Cisco RV110W Wireless-N VPN Firewalls, Cisco RV130W Wireless-N Multifunction VPN Routers, and Cisco RV215W Wireless-N VPN Routers allows a attacker to cause service interruptions.

The vulnerability in the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router web management interfaces is related to authentication process errors. Exploiting this vulnerability can allow an attacker to disable clients...

CVE-2019-12325

The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device DoS without authentication or execute code authenticated as a user to spawn a remote shell as a root user...

PT-2019-12754

Name of the Vulnerable Software and Affected Versions Htek UC902 VoIP phone version 2.0.4.4.46 Description The issue concerns buffer overflow vulnerabilities in the web management interface of the Htek UC902 VoIP phone. These vulnerabilities can be exploited to crash the device, resulting in a...

CVE-2019-12325: Out-of-bounds Write

The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device DoS without authentication or execute code authenticated as a user to spawn a remote shell as a root user...

CVE-2019-9230

An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting XSS vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script o...

CVE-2019-1941: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability exists because the...

PT-2019-2791

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions prior to 2.4.0 Patch 9 Cisco Identity Services Engine ISE versions prior to 2.6.0 Description A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow a...

Cisco Small Business Switch Information Leakage / Open Redirect

Exploit Title: CISCO Small Business 200, 300, 500 Switches Multiple Vulnerabilities. Shodan query: /config/logoffpage.html Discovered Date: 07/03/2014 Reported Date: 08/04/2019 Exploit Author: Ramikan Website: http://fact-in-hack.blogspot.com Vendor...

PT-2019-6313

Name of the Vulnerable Software and Affected Versions Citrix SD-WAN versions 10.2.x through 10.2.2 NetScaler SD-WAN versions 10.0.x through 10.0.7 Description The issue is related to improper input validation in the management interface component of NetScaler SD-WAN and Citrix SD-WAN, which can b...

D-Link DCS-1100 and D-Link DCS-1130 Cross-Site Request Forgery Vulnerabilities (CNVD-2019-23334)

The D-Link DCS-1100 and the D-Link DCS-1130 are both network cameras from Taiwan, China-based AUO D-Link. A cross-site request forgery vulnerability exists in the D-Link DCS-1100 and DCS-1130. An attacker can exploit the vulnerability by sending simple UDP packets to access the management interfa...