CVE-2024-20414

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration...

Cisco IOS and IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration...

Dockwatch Remote Command Execution Exploit

Dockwatch is a container management web UI for docker. It runs by default without authentication, although guidance is available for how to setup credentials for access. It has a Commands feature that allows a user to run docker commands such as inspect, network, ps. Prior to fix, it did not...

RHSA-2019:3024 Red Hat Security Advisory: ovirt-web-ui security and bug fix update

Bulletin has no description...

CVE-2024-44685

The vulnerability CVE-2024-44685 affects Titan SFTP and Titan MFT Server versions 2.0.25.2426 and earlier. The root cause is that passwords and other sensitive data are exposed in clear text within the JSON response when configuring SMTP settings via the Web UI. This impacts confidentiality (high...

CVE-2024-44685

Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in clear text within the JSON response when configuring SMTP settings via the Web UI...

GHSA-32FJ-R8QW-R8W8 MindsDB Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

MindsDB Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

CVE-2024-45856

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

CVE-2024-45856

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

CVE-2024-45856

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

Chef Web UI Brute Force Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/chefwebui' require 'metasploit/framework/credentialcollection' class MetasploitModule 'Chef Web UI Brute Force Utility',...

Cisco IOX XE Unauthenticated OS Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco IOX XE unauthenticated OS command execution', 'Description' = %q This module leverages both CVE-2023-20198 and CVE-2023-20273 against...

GO-2022-0937 Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish

Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish...

CVE-2024-41774

IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 3503...

Security Bulletin: IBM Common Licensing is vulnerable to stored cross-site scripting in IBM LKS Administration Reporting Tool and its Agent.

Summary IBM LKS Administration Reporting Tool and its Agent are vulnerable to stored cross-site scripting. This has been addressed in the remediation section Vulnerability Details CVEID:CVE-2024-41774 DESCRIPTION: IBM Common Licensing is vulnerable to stored cross-site scripting. This vulnerabili...

Cisco Smart Software Manager On-Prem Password Change (cisco-sa-cssm-auth-sLw3uhUy)

According to its self-reported version, Cisco Smart Software Manager On-Prem Password Change is affected by a vulnerability. - A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to change the password of...

Malicious code in iva-react-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94e079d8c7b731da869ff846e164d4a9c87faed0108d764e4048bde129a25f17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7965 Malicious code in iva-react-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94e079d8c7b731da869ff846e164d4a9c87faed0108d764e4048bde129a25f17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cisco Small Business SPA300 Series and SPA500 Series IP Phones Web UI Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an attacker to execute arbitrary commands on the underlying operating system or cause a denial of service DoS condition. For...