CVE-2023-4667

CVE-2023-4667 affects the PAC Device web interface, where the device administrator can store malicious scripts in form fields. The stored scripts are executed when the GUI is opened by users of the webserver administration interface. Root cause: inadequate input validation and output encoding in ...

Apache Kylin 2.3.x < 2.3.3 / 2.4.x < 2.4.2 / 2.5.x < 2.5.3 / 2.6.x < 2.6.6 / 3.x < 3.0.2 Command Injection (CVE-2020-1956)

The instance of Apache Kylin running on the remote host is 2.3.x prior to 2.3.3, 2.4.x prior to 2.4.2, 2.5.x prior to 2.5.3, 2.6.x prior to 2.6.6 or 3.x prior to 3.0.2. Therefore, it is affected by a command injection vulnerability due to some restful APIs concatenating OS commands with user inpu...

PT-2023-30152 · Unknown · Pac Device

Name of the Vulnerable Software and Affected Versions: PAC Device affected versions not specified Description: The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing Cisco Firepower Management Center FMC software involves a lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks remotely...

Control iD iDSecure Authentication Bypass (CVE-2023-6329)

This module exploits an improper access control vulnerability CVE-2023-6329 in Control iD iDSecure use auxiliary/admin/http/idsecure/authbypass msf undefinedauthbypass show actions ...actions... msf undefinedauthbypass set ACTION msf undefinedauthbypass show options ...show and set options... msf...

The vulnerability in the web interface of Cisco IP phones allows attackers to carry out cross-site scripting attacks.

The vulnerability of Cisco IP Phones’ web interfaces exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to load arbitrary files.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load any desired files...

The vulnerability of the microprogramming software of Osprey Pump Controller allows a hacker to gain full access to the device’s web interface.

The vulnerability of the microprogrammed software of Osprey Pump Controller controllers is related to the use of rigidly encrypted credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full access to the device’s web interface...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a malicious actor to upload arbitrary files into the application’s root web directory.

The vulnerability of the Cisco Identity Services Engine ISE’s web management interface is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to upload arbitrary files to the application’s root web directory remotely...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a attacker to execute cross-site scripting attacks.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability in the web interface of the Aruba EdgeConnect Enterprise network management platform allows a attacker to execute arbitrary code.

The vulnerability of the web interface for managing the Aruba EdgeConnect Enterprise network management platform exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Ironman Software PowerShell Universal Security Vulnerability

Ironman Software PowerShell Universal is a single pane for managing and delegating access to automation environments from Ironman Software. A security vulnerability exists in Ironman Software PowerShell Universal versions 3.0.0 through 4.2.0, which stems from an invalid filtering of input strings...

The vulnerability of the web interface of Technicolor TG670 router software, related to the possibility of using strictly encrypted login credentials, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the web interface of the microprogramming software for the Technicolor TG670 lies in the possibility of using hard-coded credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2023-20272

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this...

CVE-2023-20208

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device...

CVE-2023-20265

A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation ...

CVE-2023-20208

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device...

CVE-2023-20272

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device...

CVE-2023-20272

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this...