The vulnerability of the web-based application of D-Link DIR-X1860 wireless routers allows a hacker to execute arbitrary code.

The vulnerability of the web application of D-Link DIR-X1860 Wi-Fi routers is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created website...

The vulnerability in the web interface of the Cisco Orbital endpoint protection service allows a hacker to redirect users to any desired website.

The vulnerability of the Cisco Orbital endpoint protection service’s web interface is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect a user to any desired website remotely...

Aruba AOS-CX 跨站脚本漏洞

Aruba AOS-CX is a modern programmable network from Aruba, USA. The Aruba OS AOS-CX suffers from a cross-site scripting vulnerability that stems from a lack of filtering and escaping of user-submitted parameters in the software. An attacker can trigger cross-site scripting in AOS-CX via the...

CVE-2022-20659

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This...

SQL Injection Vulnerability in Damon Enterprise Manager (DEM)

Damon Enterprise Manager DEM is a centralized management platform that monitors, manages and maintains DM databases through a web interface. A SQL injection vulnerability exists in Damon Enterprise Manager DEM, which can be exploited by attackers to obtain sensitive database information...

PT-2022-6629 · Zyxel · Zyxel Dx5401-B0

Name of the Vulnerable Software and Affected Versions: ZyXEL DX5401-B0 firmware versions prior to V5.17ABYO.1C0 Description: The issue is related to insufficient protection of service data in the CGI "Export Log" component of the ZyXEL DX5401-B0 firmware. This could allow a remote unauthenticated...

CVE-2021-43106

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...

CVE-2021-43106

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...

CVE-2021-43106

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...

Design/Logic Flaw

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...

CVE-2021-43106

CVE-2021-43106 affects Compass Plus TranzWare Online FIMI Web Interface (TWO) version 5.3.33.3 F38 and FIMI 4.2.19.4. The root cause is improper validation/escaping of the HTTP Host header, leading the server to trust the Host header and redirect requests to a different Domain/IP. Documented impa...

CVE-2021-43106

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...

PT-2022-5106 · Moxa · Moxa Mxview

Name of the Vulnerable Software and Affected Versions: Moxa MXView version 3.2.4 Description: The issue is related to the use of hardcoded credentials in the web interface of Moxa MXView, allowing a remote attacker to gain full access to the device by sending a specially crafted HTTP request. Thi...

CVE-2022-0020

A stored cross-site scripting XSS vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators...

CVE-2022-20680

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper enforcement of Administrator privilege levels for low-value sensitive dat...

Input validation

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper enforcement of Administrator privilege levels for low-value sensitive dat...

CVE-2022-20680

CVE-2022-20680 affects Cisco Prime Service Catalog. The vulnerability arises from improper enforcement of Administrator privilege levels for low-value sensitive data in the web-based management interface. An attacker with read-only Administrator access can send a crafted HTTP request to the page ...

CVE-2022-22807

A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: EcoStruxure EV Charging Expert former...

Design/Logic Flaw

A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: EcoStruxure EV Charging Expert former...