Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper...

CVE-2021-20997

In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users...

Default credentials

In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users...

Code injection

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

CVE-2021-20997

CVE-2021-20997 affects multiple WAGO managed switches. It enables reading password hashes of all Web-based Management users. NVD reports CVSSv3.1 base score 7.5 (NETWORK, LOW attack complexity, no privileges required) with HIGH confidentiality impact; CVSSv2 base score 5.0 (PARTIAL confidentialit...

CVE-2021-20994

CVE-2021-20994 concerns a cross-site scripting vulnerability in WAGO 750-88x series managed switches. The root cause is insufficient validation of client-side data in the WEB application, allowing an attacker to trick a legitimate user into clicking a link that injects malicious code into the web...

CVE-2021-20994 WAGO: Managed Switches: Reflected Cross-site Scripting

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

Cisco Unity Connection XSS (cisco-sa-cucm-xss-Q4PZcNzJ)

The Cisco Unity Connection installed on the remote host is prior to version 14. It is, therefore, affected by multiple cross-site Scripting vulnerabilities. Multiple vulnerabilities in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to...

CVE-2021-20994: Improper Neutralization of Input During Web Page Generation

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

Cisco Unified Communications Manager XSS (cisco-sa-cucm-xss-Q4PZcNzJ)

The version of cisco unified communications manager installed on the remote host is prior to version 14. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Multiple vulnerabilities in the web-based management interface of Cisco Unified CM, could allow an unauthenticated,...

Cisco Unified Communications Manager IM & Presence Service XSS (cisco-sa-cucm-xss-Q4PZcNzJ)

The version of Cisco Unified Communications Manager IM & Presence Service installed on the remote host is prior to version 14. It is, therefore, affected by a cross-site scripting vulnerability. A vulnerability in the web-based management interface of Cisco Unified CM IM&P,could allow an...

CVE-2021-1497

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-1499

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerabilit...

CVE-2021-1498

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-1400

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more informatio...

Sql injection

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted...

CVE-2021-1365 Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted...

CVE-2021-1397 Cisco Integrated Management Controller Open Redirect Vulnerability

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An...

CVE-2021-1400 Cisco Small Business 100, 300, and 500 Series Wireless Access Points Vulnerabilities

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more informatio...

CVE-2021-1400 Cisco Small Business 100, 300, and 500 Series Wireless Access Points Vulnerabilities

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more informatio...