Command injection

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

Command injection

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient user...

Path traversal

An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system...

CVE-2023-22777 Authenticated Information Disclosure in ArubaOS Web-based Management Interface

An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system...

CVE-2023-22761 Authenticated Remote Command Execution in ArubaOS Web-based Management Interface

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

CVE-2023-22760

CVE-2023-22760 refers to authenticated remote command injection in ArubaOS Web-based management interface. The vulnerability arises from inadequate input handling in the web UI, enabling an authenticated attacker to execute arbitrary commands as a privileged user on the underlying OS, potentially...

CVE-2023-22758 Authenticated Remote Command Execution in ArubaOS Web-based Management Interface

Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

Security Bulletin: IBM b-type SAN switches and directors affected by XSS vulnerabilities CVE-2017-6225.

Summary Fabric OS is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the web-based management interface. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser with...

CVE-2022-45137

The configuration backend of the web-based management is vulnerable to reflected XSS Cross-Site Scripting attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability...

CVE-2022-45139

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...

CVE-2022-45138

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the devic...

Cross site scripting

The configuration backend of the web-based management is vulnerable to reflected XSS Cross-Site Scripting attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability...

CVE-2022-45139 WAGO: Origin validation error through CORS misconfiguration

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...

CVE-2022-45139 WAGO: Origin validation error through CORS misconfiguration

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...

CVE-2022-45139

CVE-2022-45139 (Wago): A CORS misconfiguration in the web-based management causes disclosure of basic information pages, potentially exposing device information when combined with CVE-2022-45138. Affected product: Wago web-based management interfaces. Root cause: misconfigured CORS controls allow...

CVE-2022-45138

CVE-2022-45138 affects Wago web-based management: the configuration backend can be accessed by unauthenticated users, enabling read/write of device parameters and potentially full device compromise. Root cause per sources is missing authentication/authorization on the web-based API. Impact descri...

CVE-2022-45138 WAGO: Missing Authentication for Critical Function

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the devic...

CVE-2022-45137 WAGO: Reflective Cross-Site Scripting

The configuration backend of the web-based management is vulnerable to reflected XSS Cross-Site Scripting attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability...