13671 matches found
CVE-2018-16499
In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle attacks. Usage of unapproved SSH encryption protocols or cipher suites also violates the Data Protection TSR Technical Security Requirements...
CVE-2002-2405
Check Point FireWall-1 4.1 and Next Generation NG, with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall...
CVE-2002-1999
HP Praesidium Webproxy 1.0 running on HP-UX 11.04 VVOS could allow remote attackers to cause Webproxy to forward requests to the internal network via crafted HTTP requests...
CVE-2009-2976
Cisco Aironet Lightweight Access Point AP devices send the contents of certain multicast data frames in cleartext, which allows remote attackers to discover Wireless LAN Controller MAC addresses and IP addresses, and AP configuration details, by sniffing the wireless network...
CVE-1999-0528
A router or firewall forwards external packets that claim to come from inside the network that the router/firewall is in front of...
PT-2025-22356
Name of the Vulnerable Software and Affected Versions Rakessh Ads24 Lite versions through 1.0 Fortinet affected versions not specified Description A Reflected Cross-site Scripting issue exists in Rakessh Ads24 Lite. This allows for improper neutralization of input during web page generation...
ABUP IoT Cloud Platform
RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize...
TOTOLINK A3002R and A3002RU Command Injection Vulnerability
The TOTOLINK A3002R and A3002RU are routers from TOTOLINK that support a wide range of network features and services. The TOTOLINK A3002R and A3002RU are vulnerable to a command injection vulnerability that originates from misuse of the /boafrm/formMapDelDevice file of the HTTP POST request...
D-Link DIR-605L sysCmd Parameter Command Injection Vulnerability
The D-Link DIR-605L is a wireless router from China's AUO D-Link. The D-Link DIR-605L suffers from a command injection vulnerability that stems from the parameter sysCmd failing to properly filter constructed command special characters, commands, and so on. No details of the vulnerability are...
ABB Cylon FLXeon 9.3.5 (bbmdList.js) Authenticated Config Poisoning
Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
📄 ABB Cylon FLXeon 9.3.5 bbmdList.js Authenticated Configuration Poisoning
The ABB Cylon FLXeon BACnet controller suffers from a configuration poisoning vulnerability in the put function of bbmdList.js, where the writeFile function is invoked to persist user-controlled data req.body.bipList and req.body.natList directly into sensitive configuration files /etc/bdt.txt an...
CVE-2025-29830
Use of uninitialized resource in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to disclose information over a network...
CVE-2025-29968
Improper input validation in Active Directory Certificate Services AD CS allows an authorized attacker to deny service over a network...
CVE-2025-29958
Use of uninitialized resource in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to disclose information over a network...
D-Link DIR-880L /htdocs/ssdpcgi File Command Injection Vulnerability
The D-Link DIR-880L is a dual-band Gigabit wireless router from China's AUO D-Link. The D-Link DIR-880L suffers from a command injection vulnerability, which arises from the failure of the file /htdocs/ssdpcgi in the component Request Header Handler to correctly filter the constructed command...
CVE-2025-26646
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network...
CVE-2025-30387
Improper limitation of a pathname to a restricted directory 'path traversal' in Azure allows an unauthorized attacker to elevate privileges over a network...
CVE-2025-29826
CVE-2025-29826 is reported as a Microsoft Dataverse elevation-of-privilege vulnerability caused by improper handling of permissions. The initial description and multiple connected sources consistently identify Microsoft Dataverse as the affected product and an authorization-based privilege escala...
Microsoft Dataverse Elevation of Privilege Vulnerability
Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network...