SUSE CVE-2014-3537

The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/...

SUSE CVE-2014-5031

The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors...

SUSE CVE-2017-7178

CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves 1 hosting a crafted plugin that executes an arbitrary program from its init.py file and 2 causing the victim to download, install, and enable this plugin...

SUSE CVE-2017-15092

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content...

SUSE CVE-2018-4300

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10...

SUSE CVE-2018-11769

CouchDB administrative users before 2.2.0 can configure the database server via HTTPS. Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's...

SUSE CVE-2018-18836

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data in web/api/webapiv1.c...

SUSE CVE-2020-8233

A command injection vulnerability exists in EdgeSwitch firmware v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges...

SUSE CVE-2020-14196

In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced...

SUSE CVE-2021-3427

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's...

SUSE CVE-2022-1143

Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools...

SUSE CVE-2022-3314

Use after free in logging in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

PT-2023-6679 · NetGear · Netgear Wndr3700V2

Name of the Vulnerable Software and Affected Versions: Netgear WNDR3700v2 version 1.0.1.14 Description: A vulnerability was found in the Web Interface component of the Netgear WNDR3700v2 router, which can be exploited to cause a denial of service. The attack may be initiated remotely. The issue i...

CVE-2023-22855

CVE-2023-22855 affects Kardex Mlog MCC 5.7.12+0-a203c2a213-master. A user-controllable path is passed to Path.Combine in the MCC web interface (port 8088) without proper sanitisation, enabling file inclusion on local/SMB shares and, when a .t4 template is processed by mono/t4, remote code executi...

The vulnerability in the web interface of the security, automation, and response platform Cortex XSOAR allows a attacker to read arbitrary files.

The vulnerability of the web interface of the security, automation, and response platform Cortex XSOAR is related to improper external control of the file name or file path. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

PT-2023-2591 · Cisco · Cisco Nexus Dashboard

Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard affected versions not specified Description: The issue is related to the web-based management interface of Cisco Nexus Dashboard, where insufficient user input validation allows for cross-site scripting XSS attacks. An...

NETGEAR WNDR3700 命令注入漏洞

The NETGEAR WNDR3700 is a wireless router from NETGEAR. The NETGEAR WNDR3700 suffers from a command injection vulnerability that stems from problematic unknown code in the component Web Interface, no details of the vulnerability are provided at this time...

The vulnerability in the web interface of the Pulse Connect Secure VPN server for corporate networks allows a perpetrator to execute arbitrary code.

The vulnerability in the web interface of the administrator’s VPN server for corporate networks, Pulse Connect Secure, is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

NETGEAR WNDR3700 安全漏洞

The NETGEAR WNDR3700 is a wireless router from NETGEAR. A security vulnerability exists in the NETGEAR WNDR3700 version 1.0.1.14, which stems from a problem with certain unknown processing of the component Web Interface that can lead to a denial of service...

PT-2023-1511 · NetGear · Netgear Wndr3700V2

Name of the Vulnerable Software and Affected Versions: Netgear WNDR3700v2 version 1.0.1.14 Description: A critical vulnerability has been found in the Web Interface component of the Netgear WNDR3700v2 router. The issue is related to the lack of input data sanitization, which can lead to command...