NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load And Administrator Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset', 'Description' = %q The NVRmini 2...

SerComm Device Configuration Dump

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Web Management', 'user' = /httpusername=\S+/i, 'pass' = /httppassword=\S+/i , 'HTTP Web Management Login', 'user' = /loginusername=\S+/i,...

CVE-2024-20486

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

Barix SIP Client Web Management 信息泄露漏洞

Barix SIP Client Web Management is an audio management platform from Barix, Inc. An information disclosure vulnerability exists in Barix SIP Client Web Management v02.07. FW vVB1.18, which originates from the disclosure of sensitive information to unauthorized actors...

Vulnerabilities fixed in Cisco Small Business IP Phones

Cisco has fixed vulnerabilities in the firmware of Small Business IP Phone systems. A malicious party could exploit the vulnerabilities to execute arbitrary code on the vulnerable system without prior authentication. For successful exploitation, the malicious party must have access to the...

The vulnerability of the command-line interface (CLI) of the Cisco AsyncOS operating system for Cisco Secure Web Appliances (formerly known as “Cisco Web Security Appliances”) allows a attacker to execute arbitrary system commands.

The vulnerability of the command-line interface CLI of the Cisco AsyncOS operating system’s web management interface allows attackers to execute arbitrary system commands. This vulnerability is related to incorrect input validation. Exploiting this vulnerability enables attackers to execute...

CVE-2024-20443

Cisco ISE CVE-2024-20443 affects the web-based management interface with stored XSS due to insufficient input validation. An authenticated, low-privilege user could inject malicious scripts into specific pages, potentially executing code in the interface context or accessing browser-based informa...

SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34373)

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from the lack of the HTTPOnly flag in a session cookie associated with the router's web management interface. An attacker can exploit...

SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34377)

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a missing security flag in a session cookie associated with the router's web management interface. An attacker could exploit thi...

CVE-2024-41915

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in...

CVE-2024-24257

An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script to the csl/user component...

CVE-2024-41685

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable syste...

SyroTech SY-GPON-1110-WDONT 安全漏洞

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from the lack of the HTTPOnly flag in a session cookie associated with the router's web management interface. An attacker can exploit...

SyroTech SY-GPON-1110-WDONT 安全漏洞

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a missing security flag in a session cookie associated with the router's web management interface. An attacker could exploit thi...

ZKTeco Central Control Attendance Machine Web Management Platform 安全漏洞

ZKTeco Central Control Attendance Machine Web Management Platform is a centralized control time and attendance machine web management platform from ZKTeco, China. A security vulnerability exists in Zkteco Central Control Attendance Machine Web Management Platform version v.3.0. An attacker can...

Solar-Log 1000 安全漏洞

Solar-Log 1000 is a solar photovoltaic data logger from the German company Solar-Log. A security vulnerability exists in Solar-Log 1000 prior to version 2.8.2 Build 52, which stems from the presence of a False Privilege Modification vulnerability that could allow an attacker to gain administrativ...

PT-2024-29504 · Syrotech · Sy-Gpon-1110-Wdont Router

Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: The issue arises from a missing secure flag for session cookies associated with the router's web management interface. An attacker with remote access could exploi...

CVE-2024-24257

An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script to the csl/user component...

PT-2024-20328 · Skteco.Com · Skteco.Com Central Control Attendance Machine Web Management Platform

Name of the Vulnerable Software and Affected Versions: skteco.com Central Control Attendance Machine web management platform version 3.0 Description: The issue allows an attacker to obtain sensitive information via a crafted script to the "csl/user" component. Recommendations: For version 3.0,...

Hewlett Packard Enterprise EdgeConnect SD-WAN 安全漏洞

Hewlett Packard Enterprise EdgeConnect SD-WAN is Hewlett Packard Enterprise's secure network foundation for Zero Trust and SASE. It includes best-in-class SD-WAN and next-generation firewalls that deliver unrivaled quality of experience and advanced security. A security vulnerability exists in th...