HPE System Management Homepage Authentication Bypass Vulnerability

HPE System Management Homepage is a Web-based interface from Hewlett Packard Enterprise. A security vulnerability exists in HPE System Management Homepage that allows an attacker to submit a special request to bypass authentication and gain unauthorized access...

PT-2017-12430 · Cisco · Cisco Unified Intelligence Center

Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center affected versions not specified Description: A vulnerability in the web interface could allow an unauthenticated, remote attacker to perform a Document Object Model DOM-based cross-site scripting attack. This...

Cisco SocialMiner XML External Entity Injection Vulnerability

Cisco SocialMiner is the United States Cisco Cisco a social media call center solution. The solution supports social media monitoring and analytics. An XML external entity injection vulnerability exists in the web-based user interface of Cisco SocialMiner, which arises from the program's failure ...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability

Cisco Firepower Management Center is a new generation of firewall management center software from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the web-based management interface in Cisco Firepower Management Center, which results from the program failing to...

Cisco AsyncOS Software Command Injection Vulnerability

The Cisco AsyncOS operating system is available to enhance the security and performance of Cisco email security appliances. A security vulnerability exists in the web interface of the Cisco Web Security Appliance WSA. an authenticated remote attacker performs command injection to elevate privileg...

CVE-2017-6700

A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a Document Object Model DOM based environment or client-side cross-site scripting XSS attack against a us...

Foscam Indoor IP Camera C1 SeriesCGIProxy.fcgi SMTP Test Password Parameter Configuration Command Injection Vulnerability

Foscam Indoor IP Camera C1 Series is a C1 series wireless IP camera product from Foscam China. A security vulnerability exists in the web management interface of the Foscam Indoor IP Camera C1 Series using the 2.52.2.37 application firmware. The vulnerability can be exploited to inject arbitrary...

Foscam C1 Indoor HD Camera cgiproxy.fcgi -DNS1.address configuration command injection vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A security vulnerability exists in the web management interface in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. The vulnerability can be exploited to inject arbitrary shell characters by sendi...

Foscam Indoor IP Camera C1 Series Command Injection Vulnerability

Foscam Indoor IP Camera C1 Series is a C1 series wireless IP camera product from Foscam China. A security vulnerability exists in the web management interface of the Foscam Indoor IP Camera C1 Series using the 2.52.2.37 application firmware. The vulnerability can be exploited to inject arbitrary...

Foscam Indoor IP Camera C1 Series Command Execution Vulnerability

Foscam Indoor IP Camera C1 Series is a C1 series wireless IP camera product from Foscam China. A security vulnerability exists in the web management interface of the Foscam Indoor IP Camera C1 Series using application firmware 2.52.2.37. The vulnerability can be exploited to inject arbitrary data...

IBM Sterling B2B Integrator suffers from an unspecified cross-site scripting vulnerability (CNVD-2017-15845)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...

HOME SPOT CUBE2 vulnerable to improper authentication in WebUI

Overview HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains improper authentication in WebUI. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

CVE-2017-6670

A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.17ER1...

Sunell IPCAMERA IPR54/14AKDN(II)/13 Cross Site Scripting

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Sunell IPCAMERA IPR54/14AKDNII/13 1 Vendor: Shenzhen Sunell Technology Corporation CSNC ID: CSNC-2017-010 Subject: Reflected Cross-Site Scripting Risk: High Effect: Remotely exploitable Author: Stephan Sekula...

Cisco Remote Expert Manager Information Disclosure Vulnerability

Cisco Remote Expert Manager Software is the United States Cisco Cisco a remote management software. The software remote screen sharing, screen annotation and session recording and other collaborative functions. Cisco Remote Expert Manager Software has an information disclosure vulnerability in th...

CVE-2017-7909

A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client authentication and redirect unauthorized users. Attackers may intercept requests and bypass authentication to access...

Cisco Integrated Management Controller Hijacked Session Vulnerability

Cisco Integrated Management Controller IMC is the U.S. Cisco Cisco company a set of tools for the management of the UCS Unified Computing System, which supports HTTP, SSH access, etc., and can be on the server, shutdown and reboot operations. A security vulnerability exists in the session...

The vulnerability of the Cisco Unified Communications Manager system allows a perpetrator to obtain information about the operating system.

The vulnerability in the web interface of the Cisco Unified Communications Manager system exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to obtain information about the operating system through cross-sit...

Cisco Wireless LAN Controller Denial of Service Vulnerability (CNVD-2017-05525)

The Cisco WLC is responsible for system-wide wireless LAN functions such as security policy, intrusion protection, RF management, quality of service, and mobility. Cisco Wireless LAN Controller WLC version 8.3.102.0, a security vulnerability exists in the Web management interface. An...

D-Link DWR-116 Arbitrary File Download Vulnerability

The DWR-116 is a wireless N300 multi-WAN router from D-Link. An arbitrary file download vulnerability exists in the web interface of the D-Link DWR-116, which can be exploited by a remote attacker to read an arbitrary file via a "GET /uir/" request.... double dot in the "GET /uir/" request to rea...