PT-2022-3298 · Trueconf · Trueconf Server

Name of the Vulnerable Software and Affected Versions: TrueConf Server version 4.3.7 Description: The issue is related to the failure to neutralize script-related HTML tags on a web page, which can lead to basic cross-site scripting Stored. This can be initiated remotely. The exploit has been...

IBM Security Guardium 跨站脚本漏洞

IBM Security Guardium is a suite of data protection features from IBM. The platform includes features such as custom UI, report management, and streamlined audit process building. IBM Security Guardium version 11.4 has a cross-site scripting vulnerability that stems from allowing users to embed...

The vulnerability of the web interface for controlling Siemens SICAM P850 and Siemens SICAM P855 multifunctional measuring devices allows a intruder to disclose protected information.

The vulnerability of the web interface for controlling Siemens SICAM P850 and SICAM P855 multifunctional measuring devices is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of HID Mercury programmable logic controllers’ microprogramming software, related to security mechanism failures, allows a intruder to alter the “notes” section on the web interface’s home page.

The vulnerability of HID Mercury programmable logic controllers’ microprogramming software is related to security mechanism errors. Exploiting this vulnerability could allow a malicious actor to modify the “notes” section on the web interface’s home page using a specially created package...

CVE-2022-20828

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerabilit...

CVE-2022-32534

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands...

CVE-2022-32534

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands...

CVE-2022-32534

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands...

Command injection

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands...

Flaws in Smart Jacuzzi App Could Be Exploited To Extract Users’ Data

By Deeba Ahmed The vulnerability existed in Jacuzzi Brand LLC’s SmartTub app web interface that could reveal users private data to… This is a post from HackRead.com Read the original post: Flaws in Smart Jacuzzi App Could Be Exploited To Extract Users Data...

Bosch Ethernet switch PRA-ES8P2S 操作系统命令注入漏洞

Bosch Ethernet switch PRA-ES8P2S is a switch from Bosch, Germany. An operating system command injection vulnerability exists in Bosch Ethernet switch PRA-ES8P2S 1.01.05 and earlier software versions, which originates from an easy command injection via its web interface and can be exploited by an...

The vulnerability of the MinIO object storage server, related to insecure management of privileges, allows attackers to elevate their privileges.

The vulnerability of the MinIO object storage server is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to enhance their privileges through calls to the HTTP API...

CVE-2022-20828

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerabilit...

CVE-2021-39047

IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

The vulnerability of the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W lies in insufficient validation of input data. This allows an attacker to execute arbitrary code or trigger a service failure by sending specially crafted HTTP packets.

The vulnerability of the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a service...

The vulnerability of the external authentication function of the Cisco Secure Email and Web Manager (formerly known as Cisco Security Management Appliance and Cisco Email Security Appliance) relates to access control errors, allowing attackers to gain full access to the device’s web interface.

The vulnerability of the external authentication function of Cisco Secure Email and Web Manager formerly known as Cisco Security Management Appliance and Cisco Email Security Appliance is related to access control errors. Exploiting this vulnerability can allow an attacker, operating remotely, to...

Cisco Email Security Appliance Information Disclosure (cisco-sa-esasma-info-dsc-Q9tLuOvM)

According to its self-reported version, Cisco Email Security Appliance is affected by an information disclosure vulnerability in the web management interface. This could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol LDAP...

CVE-2022-30328

An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface...

CVE-2022-30329

An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. An OS injection vulnerability exists within the web interface, allowing an attacker with valid credentials to execute arbitrary shell commands...

CVE-2022-30328

An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface...