CVE-2025-20361 Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of...

Ruckus Wireless ICX Switches Cross-site Scripting and Cross-site Request Forgery (CVE-2023-39905)

A vulnerability in the web-based management interface of the RUCKUS ICX product line could allow a remote attacker to execute XSS and CSRF attacks against the user of the interface. To exploit this vulnerability, an attacker would require the targeted user to click a crafted link that would send ...

The vulnerability in the web interface of Cisco IOS XE allows attackers to perform cross-site scripting attacks.

The vulnerability in the web interface of Cisco IOS XE operating systems is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Security Bulletin: TS4500 Tape Library/Diamondback Tape Library addresses security vulnerability CVE-2025-36088

Summary The web GUI did not sufficiently sanitize user input in certain dialogs, allowing HTML or JavaScript to be stored and later displayed to other users. Malicious code would only execute if a user opened the affected event entry. The issue has been resolved by adding proper input sanitizatio...

CVE-2025-9495 Viessmann Vitogate 300 Authentication Bypass

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attack...

CVE-2025-37128

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

Vulnerabilities fixed in HPE Aruba Networking EdgeConnect SD-WAN Gateways

HPE has fixed vulnerabilities in HPE Aruba Networking EdgeConnect SD-WAN Gateways. The vulnerabilities are in the command-line interface and Web API of the HPE Aruba Networking EdgeConnect SD-WAN Gateways. These vulnerabilities allow authenticated attackers to execute arbitrary system commands wi...

Cisco Integrated Management Controller Virtual Keyboard Video Monitor Stored XSS (cisco-sa-ucs-kvmsxss-6h7AnUyk)

According to its self-reported version, Cisco Integrated Management Controller Virtual Keyboard Video Monitor Stored Cross-Site Scripting is affected by a vulnerability. - A vulnerability in the Virtual Keyboard Video Monitor vKVM connection handling of Cisco Integrated Management Controller IMC...

The vulnerability of the web interfaces of TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 software-defined routers allows a hacker to execute arbitrary commands.

The vulnerability of the web interfaces of TP-Link Archer C7EU V2 and TL-WR841N/NDMS V9 routers lies in the lack of measures to neutralize specific components. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

IBM Concert Software Cross-Site Scripting Vulnerability

IBM Concert Software is IBM's generative AI-driven automated application management and monitoring tool based on the WatsonX platform, focused on optimizing the operational efficiency and reliability of applications. A cross-site scripting vulnerability exists in IBM Concert Software, which can b...

TOTOLINK X5000R 命令注入漏洞

TOTOLINK X5000R is a wireless router supporting Wi-Fi 6 technology with full coverage mesh system and dual-band transmission for home and business network environments. The TOTOLINK X5000R suffers from a command injection vulnerability that stems from the parameter pid in the file...

The vulnerability of the web interface of the microprogramming software for routing and switching platforms RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, and RUGGEDCOM ROX RX1400 allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the web interface of microprogramming software for routing and switching platforms such as RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, and RUGGEDCOM ROX RX1400 lies in the ability to bypass authentication procedures by using an alternative path or channel. Exploiting this...

The vulnerability of the setRebootScheCfg() function (/cgi-bin/cstecgi.cgi) in the TOTOlink EX1800T Wi-Fi extension software allows a intruder to execute arbitrary commands.

The vulnerability of the setRebootScheCfg function /cgi-bin/cstecgi.cgi of the TOTOlink EX1800T Wi-Fi extension software is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability could allow a remote attacker to...

The vulnerability of the “Load Configuration from Local PC” component of the web interface of the microprogramming software for routing and switching platforms RUGGEDCOM RST2428P, SCALANCE XC-300 Series, SCALANCE XC-400 Series, SCALANCE XCM-/XRM-/XCH-/XRH-300 Series, SCALANCE XM-400/XR-500 Series, SCALANCE XR-300 (6GK5334-xTSxx) Series, allows a attacker to compromise the integrity of protected information.

The vulnerability of the “Load Configuration from Local PC” web interface component of the microprogramming software platform for routing and switching devices, RUGGEDCOM RST2428P, SCALANCE XC-300 Series, SCALANCE XC-400 Series, SCALANCE XCM-/XRM-/XCH-/XRH-300 Series, SCALANCE XM-400/XR-500 Serie...

CVE-2025-50985

diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting XSS flaws in its web interface. Unsanitized GET parameters including maxage, maxindex, index, path, q query, and doctype are directly echoed into the HTML response, allowing attackers to inject and...

A vulnerability in the web interface for controlling Cisco IOS XE operating systems, which allows a hacker to perform a CSRF attack.

The vulnerability in the web interface for controlling Cisco IOS XE operating systems is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

The vulnerability in the web interface for controlling Cisco IOS XE operating systems allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Cisco IOS XE operating system’s web management interface relates to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and integrity...

PT-2025-34893 · Cisco · Cisco Ucs Manager

Name of the Vulnerable Software and Affected Versions: Cisco UCS Manager Software affected versions not specified Description: A vulnerability exists in the web-based management interface that could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack agains...

The vulnerability in the user interface of the VMware NSX networking virtualization platform allows attackers to perform cross-site scripting attacks.

The vulnerability of the user interface of the VMware NSX networking virtualization platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Linux Distros Unpatched Vulnerability : CVE-2017-7557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. CVE-2017-7557 Note that Nessus relies o...