IBM Security Identity Manager Cross-Site Scripting Vulnerability (CNVD-2020-10482)

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

CVE-2020-8654: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

CVE-2019-4451

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493...

Cisco Small Business Switches web UI Denial of Service Vulnerability

Cisco Small Business Switches is a Cisco enterprise switch device. An input validation vulnerability in the Cisco Small Business Switches WEB UI allows remote attackers to exploit the vulnerability to submit a special request, which can be used in a denial of service attack...

CVE-2019-4632

IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170004...

CVE-2020-7998

An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path that is accessible and hidden next to the root path. By default, there is no password set for the FTP or Web UI service...

CVE-2019-12629

A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in t...

Gener8: Clickjacking to change email address

Summary Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of the...

CVE-2019-15707

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for...

Cisco SD-WAN vManage Command Injection Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. A command injection vulnerability exists in the WebUI of Cisco SD-WAN Solution. The vulnerability stems from insufficient input validation of data parameters for certain fields. An attacke...

CVE-2020-6960

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch,...

PT-2020-19308

Name of the Vulnerable Software and Affected Versions MAXPRO VMS versions prior to VMS560 Build 595 T2-Patch MAXPRO NVR: MAXPRO NVR XE versions prior to NVR 5.6 Build 595 T2-Patch MAXPRO NVR: MAXPRO NVR SE versions prior to NVR 5.6 Build 595 T2-Patch MAXPRO NVR: MAXPRO NVR PE versions prior to NV...

CVE-2019-19843: Insufficiently Protected Credentials

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wpstoolcache...

PT-2020-19490 · Meinberg · Meinberg Lantime M300 +1

Name of the Vulnerable Software and Affected Versions: Meinberg Lantime M300 and M1000 devices affected versions not specified Description: The issue allows attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script, also known as...

Path traversal

A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and delete files with 'world' writeable permission. This issue does not affect system files that can be accessed only by root user. This issu...

JVN#07375820: Junos OS vulnerable to directory traversal

Junos OS contains a directory traversal vulnerability CWE-22. Impact Files on the server may be viewed or deleted by an authenticated J-web user. According to the developer, this issue does not affect system files that can be accessed only by root user. Solution Update the Software Update the...

CVE-2014-5287

A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface WUI...

Code injection

A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface WUI...

CVE-2014-5287

A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface WUI...

CVE-2014-5287

CVE-2014-5287 affects Kemp Load Master 7.1-16 and earlier; a Bash script injection vulnerability arises from failure to sanitize input in the Web UI. Connected sources document multiple vulnerabilities (RCE, CSRF, XSS, DoS) in Kemp Load Master 7.1-16 and earlier, with exploit references (Exploit-...