CVE-2023-21173

In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2019-18993: Improper Neutralization of Input During Web Page Generation

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992: Improper Neutralization of Input During Web Page Generation

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-17367: Cross-Site Request Forgery (CSRF)

OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/...

PT-2019-5518

Name of the Vulnerable Software and Affected Versions OpenWRT firmware version 18.06.4 Description The issue exists due to incorrect functionality of the web page structure protection mechanism in the LuCI web interface configuration of the OpenWRT embedded operating system. This can be exploited...

PT-2017-18104

Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 Description The issue concerns the use of RC4 encoding for admin network communications, despite RC4 being deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware. Recommendations For TP-Link TL-SG108...

PT-2015-3624

Name of the Vulnerable Software and Affected Versions WordPress Unconfirmed plugin versions prior to 1.2.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to "wp-admin/network/users.php"...

CVE-2014-100018: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php...

openstack-neutron: Admin-only network attributes may be reset to defaults by non-privileged users

It was discovered that unprivileged users could in some cases reset admin-only network attributes to their default values. This could lead to unexpected behavior or in some cases result in a denial of service...

DEBIAN-CVE-2014-6414

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors...

CVE-2014-6414

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors...

Design/Logic Flaw

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors...

CVE-2014-6414

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors...

UBUNTU-CVE-2014-6414

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors...

PT-2014-7214

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 2014.2.4 OpenStack Neutron version 2014.1 before 2014.1.2 Description The issue allows remote authenticated users to set admin network attributes to default values. Recommendations For OpenStack Neutron...

CVE-2014-6414: Undefined Security Weakness

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors...

PT-2014-3218

Name of the Vulnerable Software and Affected Versions Seagate BlackArmor NAS 220 version sg2000-2000.1331 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the fullna...