17446 matches found
DrayTek Vigor routers security vulnerability
DrayTek Vigor routers are a series of routers from Taiwan-based DrayTek. A security vulnerability exists in DrayTek Vigor167 version 5.2.2. A remote attacker could exploit this vulnerability to execute arbitrary system commands and escalate privileges through any account created in the web...
CVE-2023-43743
A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to th...
Sql injection
A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to th...
CVE-2023-43743
A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to th...
The vulnerability of the H2 database management system’s web interface allows attackers to escalate their privileges.
The vulnerability of the H2.svz database management system’s web interface relates to the unencrypted storage of confidential information. Exploiting this vulnerability can allow attackers to enhance their privileges...
CVE-2023-43743
A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to th...
CVE-2023-6333
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...
CVE-2023-6333
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...
CVE-2023-6333
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...
CVE-2023-33412
The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targetin...
Cross site scripting
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...
CVE-2023-6333
The CVE-2023-6333 issue affects ControlByWeb Relay devices (X-332-24I firmware 1.06; X-301-I firmware 1.15; X-301-24I firmware 1.15). Root cause: improper neutralization of input during web page generation (stored XSS). Impact: an authenticated attacker could inject arbitrary JavaScript into the ...
CVE-2023-6333 Cross-site Scripting in ControlByWeb Relays
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session...
ControlbyWeb Relay
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low attack complexity Vendor : ControlByWeb Equipment : X-332 and X-301 Vulnerability : Cross-Site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to run...
PT-2023-8803
Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices versions prior to 3.17.02 Description The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation allows remote authenticated users to execute...
Control By Web Relay Cross-Site Scripting Vulnerability
Control By Web Relay is a web control relay from Control By Web. A security vulnerability exists in Control By Web Relay X-332 and X-301, which stems from susceptibility to a stored cross-site scripting vulnerability that could allow an attacker to inject arbitrary script into the endpoints of a...
The vulnerability in the FortiOS operating system’s web interface allows attackers to circumvent existing security restrictions through brute-force attacks.
The vulnerability of the FortiOS operating system’s web interface is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions through brute-force attacks...
Cisco IP Phone Stored XSS (cisco-sa-uipphone-xss-NcmUykqA)
According to its self-reported version, Cisco IP Phone Stored Cross-Site Scripting may be affected by a cross-site scripting XSS vulnerability. Due to insufficient validation of user-supplied input, an authenticated, remote attacker can conduct an XSS attacker against a user of the interface on t...
CVE-2023-6269
An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" SBC and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticat...