Pi-hole 跨站脚本漏洞

Pi-hole is a web-grade ad-blocking application from Pi-hole, Inc. A cross-site scripting vulnerability exists in Pi-hole versions prior to 5.5.1, which stems from the fact that Pi-hole's web interface provides a central location to manage Pi-hole instances and check performance statistics.Prior t...

Buffalo Router Web Interface Detection

Binary data buffalowwwdetect.nbin...

OpenWrt Cross-Site Scripting Vulnerability

OpenWrt is a Linux operating system for embedded devices. A cross-site scripting vulnerability exists in the OpenWrt luci web-interface, which stems from insufficient cleanup of user-supplied data when processing hostnames in the OpenWrt luci web-interface. A remote attacker could inject and...

FortiSandbox - Command injection in web interface

An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests...

FortiPortal - Unrestricted file upload vulnerability

An unrestricted file upload vulnerability CWE-434 in the web interface of FortiPortal may allow a low-privileged user to potentially tamper with the underlying system's files via the upload of specifically crafted files...

CVE-2021-32019

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP...

Input validation

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP...

CVE-2021-32019

CVE-2021-32019 corresponds to a cross-site scripting (XSS) vulnerability in the OpenWrt LuCI web-interface, caused by missing input validation when processing host names on the Connection Status page. The issue allows an attacker to inject and execute HTML/script in the user’s browser, with the n...

CVE-2021-32019

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP...

PT-2021-7935 · Openwrt · Openwrt

Name of the Vulnerable Software and Affected Versions: OpenWrt versions prior to 19.07.8 Description: The issue is related to missing input validation of host names displayed in OpenWrt, which allows for XSS attacks on the Connection Status page of the luci web-interface. This can be exploited to...

The vulnerability in the web interface of the Cisco Intersight Virtual Appliance software for managing cloud systems allows a perpetrator to execute arbitrary commands with root privileges.

The vulnerability of the web interface for managing Cisco Intersight Virtual Appliance software exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands with root privileges remotely...

Security Advisory 2021-08-01-1 - XSS via missing input validation of host names displayed (CVE-2021-32019)

DESCRIPTION Missing input validation of host names displayed in OpenWrt LuCI web-interface leads to Cross-site scripting, which can be used to gain full control over the affected system. REQUIREMENTS Users need to visit the LuCI “Connection status” page of the router and activate the host name...

OpenWrt LuCI 跨站脚本漏洞

OpenWrt is a Linux operating system for embedded devices. A cross-site scripting vulnerability exists in the OpenWrt luci web-interface, which stems from insufficient cleanup of user-supplied data when processing hostnames in the OpenWrt luci web-interface. A remote attacker could inject and...

CVE-2021-20562

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.53 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

Cross site scripting

The CheckMK management web console versions 1.5.0 to 2.0.0 does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other client-side scripts, the XSS...

CVE-2021-33032

A Remote Code Execution RCE vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request...

CVE-2021-1599

A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to perform a cross-site scripting XSS attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the...

[SECURITY] Fedora 33 Update: nextcloud-19.0.13-1.fc33

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

[SECURITY] Fedora 34 Update: nextcloud-20.0.11-1.fc34

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

Cisco Intersight 路径遍历漏洞

Cisco Intersight is an application platform from Cisco, Inc. It provides a level of intelligent management that enables IT organizations to analyze, simplify, and automate their environments in a more advanced way than previous generations of tools. A path traversal vulnerability in the web...