CVE-2023-20189: Buffer Copy without Checking Size of Input

Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due t...

CVE-2023-20110: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validat...

CVE-2023-20173

Cisco Identity Services Engine (ISE) is affected by CVE-2023-20173, an XML External Entity Injection vulnerability in the web-based management interface that can allow an authenticated, remote attacker with valid Administrator credentials to read arbitrary files or perform SSRF. The exploitation ...

CVE-2023-20087

Summary: CVE-2023-20087 affects Cisco Identity Services Engine (ISE) where the web-based management interface contains input-validation errors that could let an authenticated, remote attacker download arbitrary files from the device filesystem by sending crafted HTTP requests. This is supported b...

CVE-2023-20173: Improper Restriction of XML External Entity Reference

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery SSRF attack through an affected device. To exploit these vulnerabilities, an attacker...

CVE-2023-20173 Cisco Identity Services Engine XML External Entity Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery SSRF attack through an affected device. To exploit these vulnerabilities, an attacker...

Guest Management System Cross-Site Scripting Vulnerability (CNVD-2023-41504)

The Guest Management System is a web-based system designed to monitor the records of everyone who enters a school or college. A cross-site scripting vulnerability exists in Guest Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the...

Cisco Small Business Series Switches Buffer Overflow Vulnerabilities

Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due t...

Cisco Smart Software Manager On-Prem SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validat...

PT-2023-3355

Name of the Vulnerable Software and Affected Versions Cisco Small Business Series Switches affected versions not specified Description The issue is related to multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches. These vulnerabilities could allo...

PT-2023-2806

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description The issue is related to multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE, which could allow an authenticated,...

CVE-2023-29128

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

Path traversal

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

Path traversal

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-29128

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-29128

The CVE-2023-29128 vulnerability affects SIMATIC Cloud Connect 7 CC712 (versions 2.0–2.0, up to 2.1) and CC716 (versions 2.0–2.1). The issue is a path traversal vulnerability in the upload feature of the web-based management interface, enabling an authenticated privileged remote attacker to write...

PT-2023-2628

Name of the Vulnerable Software and Affected Versions SCALANCE LPE9403 versions prior to V2.1 Description A vulnerability has been identified in the web-based management of the affected device, which does not properly validate user input, making it susceptible to command injection. This could all...

CVE-2023-27407: Improper Neutralization of Special Elements used in a Command

A vulnerability has been identified in SCALANCE LPE9403 All versions V2.1. The web based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as...

CVE-2023-29128: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

Siemens SICAM P850 and SICAM P855 Missing Authentication For Critical Function (CVE-2022-29879)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow authenticated users to access critical devic...