CVE-2023-20113 Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management...

Cisco SD-WAN vManage Software Cluster Mode Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software when it is operating in cluster mode could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due to insufficient CSRF...

CVE-2023-25592

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...

CVE-2023-25594

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to...

Design/Logic Flaw

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to complete...

Cross site scripting

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...

CVE-2023-25594

CVE-2023-25594 concerns Aruba Networks ClearPass Policy Manager, where an attacker with read-only privileges can perform state-changing actions in the web-based management interface. The underlying issue is an authorization bypass that permits higher-impact operations than the attacker’s permissi...

CVE-2023-25593 Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management Interface

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...

CVE-2023-25593

CVE-2023-25593 affects Aruba Networks ClearPass Policy Manager web-based management interface. It describes a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to execute arbitrary script in a victim’s browser within the affected interface. Public documentation and a...

CVE-2023-25592

CVE-2023-25592 describes a reflected Cross-Site Scripting (XSS) vulnerability in the web-based management interface of Aruba ClearPass Policy Manager. The issue could allow a remote attacker to supply malicious input that is reflected in the interface and executed in the victim’s browser, with th...

CVE-2023-25591 Authenticated Information Disclosure in ClearPass Policy Manager Web-Based Management Interface

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further...

CVE-2023-25591

CVE-2023-25591 affects Aruba ClearPass Policy Manager Web-Based Management Interface. An attacker authenticated with low privileges could access sensitive information via the management UI, enabling potential privilege escalation. The issue is documented across multiple feeds (NVD, CVE listings, ...

CVE-2023-25593: Improper Neutralization of Input During Web Page Generation

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...

CVE-2023-25594: Incorrect Authorization

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to...

CVE-2023-25592: Improper Neutralization of Input During Web Page Generation

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...

Wago Multiple Products Web-based Management Cross-site Scripting (CVE-2022-45137)

The configuration backend of the web-based management is vulnerable to reflected XSS Cross-Site Scripting attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability. This plugin only works with Tenable.ot. Please visit...

Cisco IP Phones < 11.3.7SR1 Multiple Vulnerabilities (cisco-sa-ip-phone-cmd-inj-KMFynVcP)

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. Please see the included Cisco BIDs and Cisco Security Advisory for more information...

Wago Multiple Products Web-based Management Missing Authentication for Critical Function (CVE-2022-45138)

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the devic...

Wago Multiple Products Web-based Management Missing Authentication for Critical Function (CVE-2022-45140)

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise. This plugin only works with Tenable.ot. Please visit...

Wago Multiple Products Web-based Management Origin Validation Error (CVE-2022-45139)

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...