CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

Design/Logic Flaw

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

CVE-2023-2993

Summary of CVE-2023-2993 (Mode C) CVE-2023-2993 affects Lenovo ThinkSystem components including SMM v1, SMM v2, and FPC. The vulnerability arises from authenticated, limited-privilege users being able to craft web management server API calls that execute a limited number of commands that the user...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

Lenovo ThinkSystem 安全漏洞

Lenovo ThinkSystem is a ThinkSystem series server device from Lenovo, a Chinese company. A security vulnerability exists in Lenovo ThinkSystem. An attacker exploited the vulnerability to execute commands without sufficient privileges on SMM v1, SMM v2, and FPC using specially designed Web...

PT-2023-22482 · Fpc +1 · Fpc +1

Name of the Vulnerable Software and Affected Versions: SMM versions 1 and 2 FPC affected versions not specified Description: A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands that the...

CVE-2023-20120

Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance ESA; and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance WSA, could allow a remote...

CVE-2023-20119

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the...

PT-2023-3311 · Cisco · Cisco Secure Web Appliance +2

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Secure Email and Web Manager versions not specified Cisco Secure Email Gateway, formerly Cisco Email Security Appliance ESA versions not specified Cisco Secure Web Appliance, formerly Cisco Web Security...

PT-2023-3471 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the...

CVE-2023-3305

A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword...

CVE-2023-3305

A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword...

Improper access control

A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword...

CVE-2023-3305

CVE-2023-3305 affects C-DATA Web Management System (up to 20230607), specifically the User Creation Handler component. The vulnerability lies in the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 where manipulating the user/newpassword parameter grants improper access control. It al...

CVE-2023-3305 C-DATA Web Management System User Creation access control

A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword...

C-DATA Web Management System 访问控制错误漏洞

C-DATA Web Management System is a web management system from China-based C-DATA Corporation. An access control error vulnerability exists in C-DATA Web Management System version 20230607 and earlier, which stems from a problem with the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1,...

CVE-2023-20105

A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker with Read-only credentials to elevate privileges to Administrator on an affected system. This vulnerability is due to...

CVE-2023-33533

Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2.26 are vulnerable to Command Injection. If an attacker gains web management privileges, they can inject commands into the post request...

CVE-2023-33532

There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges...