CVE-2013-4615

The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service device hang via a crafted LANTXT24 parameter to English/pagesMacUS/cgilan.cgi followed by a direct request to English/pagesMacUS/lansetcontent.html. NOTE: th...

CVE-2019-13268

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage ...

CVE-2019-8612

A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, tvOS 12.3, watchOS 5.2.1, macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, iO...

CVE-2019-13266

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds wi...

CVE-2019-8804

An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup...

CVE-2018-20850

Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server...

CVE-2019-3602

Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML...

CVE-2019-3597

Authentication Bypass vulnerability in McAfee Network Security Manager NSM 9.1 9.1.7.75.2 and 9.2 9.2.7.31 9.2 Update 2 allows unauthenticated users to gain administrator rights via incorrect handling of expired GUI sessions...

CVE-2019-19287

A vulnerability has been identified in XHQ All Versions 6.1. The web interface could allow attackers to traverse through the file system of the server based by sending specially crafted packets over the network without authentication...

CVE-2010-2984

Cisco Unified Wireless Network UWN Solution 7.x before 7.0.98.0 on 4404 series controllers does not properly implement the WEBAUTHREQD state, which allows remote attackers to bypass intended access restrictions via WLAN traffic, aka Bug ID CSCtb75305...

CVE-2018-16499

In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle attacks. Usage of unapproved SSH encryption protocols or cipher suites also violates the Data Protection TSR Technical Security Requirements...

CVE-2002-2405

Check Point FireWall-1 4.1 and Next Generation NG, with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall...

CVE-2002-1999

HP Praesidium Webproxy 1.0 running on HP-UX 11.04 VVOS could allow remote attackers to cause Webproxy to forward requests to the internal network via crafted HTTP requests...

CVE-2009-2976

Cisco Aironet Lightweight Access Point AP devices send the contents of certain multicast data frames in cleartext, which allows remote attackers to discover Wireless LAN Controller MAC addresses and IP addresses, and AP configuration details, by sniffing the wireless network...

CVE-1999-0528

A router or firewall forwards external packets that claim to come from inside the network that the router/firewall is in front of...

PT-2025-22356

Name of the Vulnerable Software and Affected Versions Rakessh Ads24 Lite versions through 1.0 Fortinet affected versions not specified Description A Reflected Cross-site Scripting issue exists in Rakessh Ads24 Lite. This allows for improper neutralization of input during web page generation...

ABUP IoT Cloud Platform

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize...

TOTOLINK A3002R and A3002RU Command Injection Vulnerability

The TOTOLINK A3002R and A3002RU are routers from TOTOLINK that support a wide range of network features and services. The TOTOLINK A3002R and A3002RU are vulnerable to a command injection vulnerability that originates from misuse of the /boafrm/formMapDelDevice file of the HTTP POST request...

D-Link DIR-605L sysCmd Parameter Command Injection Vulnerability

The D-Link DIR-605L is a wireless router from China's AUO D-Link. The D-Link DIR-605L suffers from a command injection vulnerability that stems from the parameter sysCmd failing to properly filter constructed command special characters, commands, and so on. No details of the vulnerability are...

📄 ABB Cylon FLXeon 9.3.5 bbmdList.js Authenticated Configuration Poisoning

The ABB Cylon FLXeon BACnet controller suffers from a configuration poisoning vulnerability in the put function of bbmdList.js, where the writeFile function is invoked to persist user-controlled data req.body.bipList and req.body.natList directly into sensitive configuration files /etc/bdt.txt an...