ControlbyWeb Relay

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low attack complexity Vendor : ControlByWeb Equipment : X-332 and X-301 Vulnerability : Cross-Site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to run...

PT-2023-8803

Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices versions prior to 3.17.02 Description The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation allows remote authenticated users to execute...

Control By Web Relay Cross-Site Scripting Vulnerability

Control By Web Relay is a web control relay from Control By Web. A security vulnerability exists in Control By Web Relay X-332 and X-301, which stems from susceptibility to a stored cross-site scripting vulnerability that could allow an attacker to inject arbitrary script into the endpoints of a...

The vulnerability in the FortiOS operating system’s web interface allows attackers to circumvent existing security restrictions through brute-force attacks.

The vulnerability of the FortiOS operating system’s web interface is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions through brute-force attacks...

Cisco IP Phone Stored XSS (cisco-sa-uipphone-xss-NcmUykqA)

According to its self-reported version, Cisco IP Phone Stored Cross-Site Scripting may be affected by a cross-site scripting XSS vulnerability. Due to insufficient validation of user-supplied input, an authenticated, remote attacker can conduct an XSS attacker against a user of the interface on t...

CVE-2023-6269

An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" SBC and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticat...

CVE-2023-43472

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

SUSE CVE-2023-30801

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...

The vulnerability of the command shell of ZySH microprogramming software for network devices such as ZyXEL USG FLEX and ATP allows a hacker to alter the URL address of the registration page.

The vulnerability of the command shell of the ZySH microprogramming software for ZyXEL USG FLEX, VPN, and ATP is related to deficiencies in access control. Exploiting this vulnerability could allow a attacker to alter the URL address of the registration page through the web interface...

Pi-hole Web Interface 2.0 <= 5.17 Broken Access Control Vulnerability

The Pi-hole Web Interface previously AdminLTE is prone to a broken access control vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

IBM InfoSphere Information Server 跨站脚本漏洞

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server, which can be...

PT-2023-9103 · Peplink · Peplink Smart Reader

Name of the Vulnerable Software and Affected Versions: Peplink Smart Reader version 1.2.0 Description: A data integrity vulnerability exists in the web interface /cgi-bin/upload config.cgi functionality. A specially crafted HTTP request can lead to configuration modification. An attacker can make...

PT-2024-13084 · Peplink · Peplink Smart Reader

Name of the Vulnerable Software and Affected Versions: Peplink Smart Reader version 1.2.0 Description: An information disclosure vulnerability exists in the web interface /cgi-bin/debug dump.cgi functionality. A specially crafted HTTP request can lead to a disclosure of sensitive information. An...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing Cisco Firepower Management Center FMC software involves a lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks remotely...

PT-2023-9054 · Peplink · Peplink Smart Reader

Name of the Vulnerable Software and Affected Versions: Peplink Smart Reader version 1.2.0 Description: A command injection vulnerability exists in the web interface's mac2name functionality. This issue arises due to the lack of measures to neutralize special elements used in operating system...

Pi-hole Web Interface <= 5.5.1 Multiple Vulnerabilities

The Pi-hole Web Interface previously AdminLTE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

The vulnerability of the WEB CLI interface (component koko) of the JumpServer security audit system allows a perpetrator to execute arbitrary commands.

The vulnerability of the WEB CLI interface component koko of the JumpServer security audit and maintenance system is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Fedora 39 : qbittorrent (2023-1bbfc445a2)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1bbfc445a2 advisory. - Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but...

CVE-2023-4667

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate...

Input validation

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate...