CVE-2021-1200

CVE-2021-1200 affects Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The web-based management interface contains input validation weaknesses that could allow an authenticated attacker with administrator credentials to execute arbitrary code as root or trigger a restart/DoS by sen...

CVE-2021-1189

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper...

CVE-2021-1189

Cisco Small Business RV110W, RV130, RV130W, and RV215W routers are affected by multiple web-management vulnerabilities caused by improper validation of user input. An authenticated attacker with valid administrator credentials could send crafted HTTP requests over the network to the affected devi...

Design/Logic Flaw

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15220

CVE-2020-15220 affects Combodo iTop (open-source IT Service Management platform). In iTop versions prior to 2.7.2 and 3.0.0, two cookies are created for the same session, enabling potential session hijacking. The issue is fixed in version 2.7.2 and in version 3.0.0. Connected sources corroborate ...

CVE-2020-15220 Session fixation

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15218 Admin pages are cached and can be embedded

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15218

Combodo iTop is affected prior to versions 2.7.2 and 3.0.0 where admin pages are cached, allowing content to be visible after a user navigates back. This is fixed in 2.7.2 and 3.0.0. The provided data indicates partial confidentiality impact with a MEDIUM/LOW severity depending on vector, and no ...

Cisco Enterprise NFV Infrastructure Software Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to improper input...

Cisco Firepower Management Center Stored Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected system. The vulnerabilities exist because the...

PT-2021-1638 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC affected versions not specified Description: The issue is related to multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC, which could allow an...

CVE-2020-4079

CVE-2020-4079 affects Combodo iTop prior to 2.7.2 and 2.8.0 where the ajax endpoint for the Excel export portal could be accessed directly, bypassing scope filtering and exposing data to users who should not have access. Root cause: missing access control on the Excel export data retrieval. Impac...

IBM Emptoris Contract Management Cross-Site Scripting Vulnerability (CNVD-2021-01992)

IBM Emptoris Contract Management is a web-based contract management software for managing and maintaining legal contracts between parties. A cross-site scripting vulnerability exists in IBM Emptoris Contract Management 10.1.3. An attacker can exploit this vulnerability to embed arbitrary JavaScri...

RCE 'Bug' Found and Disputed in Popular PHP Scripting Framework

Versions of the popular developer tool Zend Framework and its successor Laminas Project can be abused by an attacker to execute remote code on PHP-based websites, if they are running web-based applications that are vulnerable to attack. However, those that maintain Zend Framework emphasize that t...

Multiple vulnerabilities in UNIVERGE SV9500/SV8500 series

Overview Remote system maintenance feature of UNIVERGE SV9500/SV8500 series' Web based remote maintenance console contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2020-5685 Incorrect Implementation of Authentication Algorithm CWE-303 - CVE-2020-5686 NEC Platforms,...

[SECURITY] Fedora 32 Update: phpldapadmin-1.2.6.2-1.fc32

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

[SECURITY] Fedora 33 Update: phpldapadmin-1.2.6.2-1.fc33

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

Fedora: Security Advisory for phpldapadmin (FEDORA-2020-c6fa47ecd7)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-26280

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting XSS. In the web applicatio...

PYSEC-2020-72

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting XSS. In the web applicatio...