CVE-2020-16206

CVE-2020-16206 affects Red Lion N-Tron 702-W and 702M12-W (all versions). It is a stored cross-site scripting vulnerability (CWE-79) caused by improper neutralization of input during web page generation, allowing an attacker to remotely execute arbitrary code and access sensitive data. Several so...

CVE-2020-16206

The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to sensitive data on the N-Tron 702-W / 702M12-W all versions...

JITSploitation III: Subverting Control Flow

Posted by Samuel Groß, Project Zero This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed i...

CVE-2020-16206: Improper Neutralization of Input During Web Page Generation

The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to sensitive data on the N-Tron 702-W / 702M12-W all versions...

CVE-2020-16208: Cross-Site Request Forgery (CSRF)

The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authenticated user to click on a crafted link on the N-Tron 702-W / 702M12-W all versions...

PT-2020-14804 · N Tron · N-Tron 702-W +1

Name of the Vulnerable Software and Affected Versions: N-Tron 702-W / 702M12-W all versions Description: The issue arises from an undocumented interface on the device, potentially allowing an attacker to execute commands as root. Recommendations: For N-Tron 702-W / 702M12-W, consider restricting...

PT-2020-14809 · N Tron · N-Tron 702M12-W +1

Name of the Vulnerable Software and Affected Versions: N-Tron 702-W / 702M12-W all versions Description: The issue concerns reflected cross-site scripting, which could allow an attacker to execute arbitrary code and perform actions in the context of an attacked user. Recommendations: For all...

CVE-2020-16204: Hidden Functionality

The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W all versions...

PT-2020-14806 · N Tron · N-Tron 702-W +1

Name of the Vulnerable Software and Affected Versions: N-Tron 702-W / 702M12-W all versions Description: The issue concerns stored cross-site scripting, which could allow an attacker to remotely execute arbitrary code, potentially gaining access to sensitive data. Recommendations: For all version...

PT-2020-14808

Name of the Vulnerable Software and Affected Versions N-Tron 702-W / 702M12-W all versions Description The issue allows an attacker to perform cross-site request forgery, potentially enabling them to modify different device configurations. This can be achieved by luring an authenticated user into...

CVE-2020-16210: Improper Neutralization of Input During Web Page Generation

The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the context of an attacked user on the N-Tron 702-W / 702M12-W all versions...

Red Lion N-Tron 702-W/702M12-W Cross-Site Scripting Vulnerability

The Red Lion N-Tron 702-W/702M12-W is a high voltage Ethernet switch product. A cross-site scripting vulnerability exists in the Red Lion N-Tron 702-W/702M12-W, which can be exploited by a remote attacker to execute arbitrary code and perform actions in the context of the attacked user...

Red Lion N-Tron 702-W/702M12-W Unspecified Interface Vulnerability

The Red Lion N-Tron 702-W/702M12-W is a high voltage Ethernet switch product. An undocumented interface vulnerability exists in the Red Lion N-Tron 702-W/702M12-W, which can be exploited by an attacker to submit a special request to execute arbitrary commands with ROOT privileges...

CVE-2020-3446 Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnerability

A vulnerability in Cisco Virtual Wide Area Application Services vWAAS with Cisco Enterprise NFV Infrastructure Software NFVIS-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected devic...

CVE-2020-3446

CVE-2020-3446 affects Cisco vWAAS on ENCS 5400-W and CSP 5000-W with NFVIS-bundled images. An unauthenticated attacker can log into the NFVIS CLI using default, static passwords, potentially gaining administrator privileges. Exploitation requires access to the NFVIS CLI (or CIMC) on the affected ...

CVE-2020-3446: Use of Hard-coded Credentials

A vulnerability in Cisco Virtual Wide Area Application Services vWAAS with Cisco Enterprise NFV Infrastructure Software NFVIS-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected devic...

Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnerability

A vulnerability in Cisco Virtual Wide Area Application Services vWAAS with Cisco Enterprise NFV Infrastructure Software NFVIS-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected devic...

Obscured by Clouds: Insights into Office 365 Attacks and How Mandiant Managed Defense Investigates

With Business Email Compromises BECs showing no signs of slowing down, it is becoming increasingly important for security analysts to understand Office 365 O365 breaches and how to properly investigate them. This blog post is for those who have yet to dip their toes into the waters of an O365 BEC...

2019.2 IPU – Intel® Processor Security Advisory

Summary: Potential security vulnerabilities in System Management Mode SMM and Intel® Trusted Execution Technology TXT for some Intel® Core™ Processors and Intel® Xeon® Processors may allow escalation of privilege, denial of service or information disclosure. Intel is releasing firmware updates to...

The vulnerability of the IEEE 802.11w Protected Management Frames (PMFs) in the Cisco IOS XE operating system allows a hacker to disrupt a user’s legitimate connection to a vulnerable device.

The vulnerability of the IEEE 802.11w Protected Management Frames PMFs in the Cisco IOS XE operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to successfully disconnect a user’s connection to a vulnerable device...