5999 matches found
Cisco SD-WAN vManage Command Injection Vulnerability
A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in t...
Design/Logic Flaw
Meinberg Lantime M300 and M1000 devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated...
CVE-2020-7240
Meinberg Lantime M300 and M1000 devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated...
CVE-2020-7240: Improper Neutralization of Special Elements used in an OS Command
Meinberg Lantime M300 and M1000 devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated...
FortiMail admin privilege escalation through improper user profile control
Two improper access control vulnerabilities in FortiMail admin webUI may allow administrators to perform privileged functions they should not be authorized for...
CVE-2019-7004
A Cross-Site Scripting XSS vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not...
CVE-2019-7004
A Cross-Site Scripting XSS vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not...
Cross site scripting
A Cross-Site Scripting XSS vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not...
Avaya IP Office Application Server WebUI Component Cross-Site Scripting Vulnerability
Avaya IP Office Application Server is an application server from the American company Avaya. A cross-site scripting vulnerability exists in the WebUI component of IP Office Application Server version 11.x. The vulnerability stems from a lack of proper validation of client-side data in the WEB...
CVE-2019-7004: Improper Neutralization of Input During Web Page Generation
A Cross-Site Scripting XSS vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not...
PT-2019-4086
Name of the Vulnerable Software and Affected Versions FortiMail versions 5.4.10 and below FortiMail versions 6.0.0 through 6.0.6 FortiMail version 6.2.0 Description The issue is related to improper access control in the FortiMail admin webUI, which may allow a remote attacker to bypass existing...
PT-2019-4085
Name of the Vulnerable Software and Affected Versions FortiMail versions 5.4.10 and below FortiMail versions 6.0.0 through 6.0.6 FortiMail version 6.2.0 Description The issue is related to improper access control in the FortiMail admin webUI, which may allow unauthorized access to the web console...
CVE-2019-5594
An Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...
CVE-2019-5594
An Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...
Information disclosure
An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a JavaScript file through admin webUI...
CVE-2019-5594
The CVE-2019-5594 entry describes a reflected XSS in Fortinet FortiNAC admin webUI, exploitable without authentication via the search field. Affected versions are FortiNAC 8.3.0–8.3.6 and 8.5.0. The vulnerability arises from improper input neutralization during web page generation. Multiple conne...
CVE-2019-5594
An Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...
CVE-2018-13367
An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a JavaScript file through admin webUI...
CVE-2018-13367
CVE-2018-13367 affects FortiOS (Fortinet) WEB UI, where an information-exposure flaw allows unauthenticated attackers to retrieve platform details (version, models) by parsing a JavaScript file served through the admin web UI. Affected releases include FortiOS 6.2.3, 6.2.0 and earlier versions. T...
CVE-2019-5594: Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...