CVE-2023-22778 Authenticated Stored Cross-Site Scripting

A vulnerability in the ArubaOS web management interface could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the...

CVE-2023-22778

CVE-2023-22778 affects ArubaOS web management interface. The vulnerability is an authenticated stored cross-site scripting (XSS) that can allow an attacker to execute arbitrary scripts in a user’s browser within the affected interface. Affected product scope is ArubaOS-based management interfaces...

CVE-2023-22772 Authenticated Path Traversal in ArubaOS Web-based Management Interface Allows for Arbitrary File Deletion

An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system...

CVE-2023-22759

ArubaOS web-based management interface is affected by authenticated remote command injection in ArubaOS. The root cause is insufficient input handling in the web interface, allowing an attacker with valid credentials to execute arbitrary commands as a privileged OS user, potentially fully comprom...

Osprey Pump Controller 1.0.1 Administrator Backdoor Access Vulnerability

Osprey Pump Controller version 1.0.1 has a hidden administrative account admin that has the hardcoded password Mirage1234 that allows full access to the web management interface configuration. The user admin is not visible in Usernames and Passwords menu list 120 of the application and the passwo...

CVE-2022-45139

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...

CVE-2022-45137

The configuration backend of the web-based management is vulnerable to reflected XSS Cross-Site Scripting attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability...

CVE-2022-45138 WAGO: Missing Authentication for Critical Function

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the devic...

Osprey Pump Controller 1.0.1 Administrator Backdoor Access

Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...

The vulnerability in the web interface of the Cisco Application Policy Infrastructure Controller allows a attacker to execute a CSRF attack.

The vulnerability in the Cisco Application Policy Infrastructure Controller’s web management interface is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability could allow a malicious actor to execute a CSRF attack remotely...

PT-2023-14617 · Wago · 751-9301 Firmware +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A CORS misconfiguration in the web-based management allows a malicious third-party web server to misuse basic information pages, potentially leading to the disclosure of device...

CVE-2023-1009

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

CVE-2023-1009

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

CVE-2023-1009 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

CVE-2023-1009

DrayTek Vigor 2960 Web Management Interface contains a path traversal vulnerability in the function sub_1DF14 of /cgi-bin/mainfunction.cgi. Exploitation arises by manipulating the option argument with the input /../etc/passwd-, enabling remote access to sensitive files. Affected versions are 1.5....

CVE-2023-1009 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

K8602: XSS vulnerability viewing logs from the web management interface

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

K8599: XSS vulnerability viewing logs from the Console section of the web management interface

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

Design/Logic Flaw

A vulnerability was found in TP-Link Archer C50 V2160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation leads to denial of service. The attack can only be initiated within the local network. The...

CVE-2023-0936 TP-Link Archer C50 Web Management Interface denial of service

A vulnerability was found in TP-Link Archer C50 V2160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation leads to denial of service. The attack can only be initiated within the local network. The...