The vulnerability in the web interface of the Cisco Identity Services Engine, a platform for managing network policies, allows a perpetrator to execute arbitrary code.

The vulnerability in the web interface of the Cisco Identity Services Engine management platform for network policies relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with the help of speciall...

Supermicro Onboard IPMI Url_redirect.cgi Authenticated Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'uri' class MetasploitModule 'Supermicro Onboard IPMI urlredirect.cgi Authenticated Directory Traversal', 'Description' = %q This module abuses a directory...

Cisco Device HTTP Device Manager Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco Device HTTP Device Manager Access', 'Description' = %q This module gathers data from a Cisco device router or switch with the device manage...

SurgeNews User Credentials

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SurgeNews User Credentials', 'Description' = %q This module exploits a vulnerability in the WebNews web interface of SurgeNews on TCP ports 9080...

RFCode Reader Web Interface Login / Bruteforce Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'RFCode Reader Web Interface Login / Bruteforce Utility', 'Description' = % This module simply attempts to login to a RFCode Reader web interface...

Canon Printer Wireless Configuration Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'nokogiri' class MetasploitModule 'Canon Printer Wireless Configuration Disclosure', 'Description' = %q This module enumerates wireless credentials from Canon...

Control ID IDSecure Authentication Bypass

class MetasploitModule 'Control iD iDSecure Authentication Bypass CVE-2023-6329', 'Description' = %q This module exploits an improper access control vulnerability CVE-2023-6329 in Control iD iDSecure 'Michael Heinzl', MSF Module 'Tenable' Discovery and PoC , 'References' = 'CVE', '2023-6329',...

Ivanti Virtual Traffic Manager Authentication Bypass

class MetasploitModule 'Ivanti Virtual Traffic Manager Authentication Bypass CVE-2024-7593', 'Description' = %q This module exploits an access control issue in Ivanti Virtual Traffic Manager vTM, by adding a new administrative user to the web interface of the application. Affected versions includ...

Pi-Hole Top Domains API Authenticated Exec

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pi-Hole Top Domains API Authenticated Exec', 'Description' = %q This exploits a command execution in Pi-Hole Web Interface API/Web inetrace page...

Cisco DCNM Auth Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'securerandom' require 'base64' class MetasploitModule 'Cisco DCNM auth bypass', 'Description' = %q This exploit is able to add an admin account to a Cisco DCNM...

IBM Lotus Notes Sametime User Enumeration

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'enumerable' class MetasploitModule 'IBM Lotus Notes Sametime User Enumeration', 'Description' = %q This module extracts usernames using the IBM Lotus Notes...

IBM Lotus Notes Sametime Room Name Bruteforce

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'enumerable' class MetasploitModule 'IBM Lotus Notes Sametime Room Name Bruteforce', 'Description' = %q This module bruteforces Sametime meeting room names via t...

Arris / Motorola Surfboard SBG6580 Web Interface Takeover

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Arris / Motorola Surfboard SBG6580 Web Interface Takeover', 'Description' = %q The web interface for the Arris / Motorola Surfboard SBG6580 has...

PT-2024-5939 · Roxy-Wi · Roxy-Wi

Name of the Vulnerable Software and Affected Versions: Roxy-WI affected versions not specified Description: The issue is related to an OS Command Injection vulnerability in the Roxy-WI web interface for managing servers. This vulnerability allows any authenticated user to execute arbitrary code o...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CNVD-2024-37702)

Cisco Unified Communications Manager is a call processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists in Cisco Unified...

ROS-20240828-01

A vulnerability in the koji RPM-based build system is related to improper neutralization of input data during the during web page generation. Exploitation of the vulnerability could allow an attacker to conduct XSS attacks using a specially crafted web interface. using a specially crafted web...

The vulnerability in the session_login.cgi script of the Webmin hosting panel and the web interface for Unix-like systems, Usermin, allows attackers to perform cross-site scripting attacks.

The vulnerability in the sessionlogin.cgi script of the Webmin hosting panel and the web interface for Unix-like systems Usermin exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripti...

The vulnerability in the web interface of SSL-VPN operating systems FortiOS and proxy servers for protecting against Internet attacks by FortiProxy allows attackers to perform cross-site scripting attacks.

The vulnerability of the SSL-VPN web interface for FortiOS operating systems and FortiProxy proxy servers exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site attacks, provided that the use...

PT-2024-38822 · D Link · Dns-320L +18

Name of the Vulnerable Software and Affected Versions: D-Link DNS-120 up to 20240814 D-Link DNR-202L up to 20240814 D-Link DNS-315L up to 20240814 D-Link DNS-320 up to 20240814 D-Link DNS-320L up to 20240814 D-Link DNS-320LW up to 20240814 D-Link DNS-321 up to 20240814 D-Link DNR-322L up to...

CVE-2024-37392

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...