CVE-2020-18885

Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/webconfig.php'...

PT-2021-10249 · Phpmywind · Phpmywind

Name of the Vulnerable Software and Affected Versions: PHPMyWind version 5.6 Description: The issue allows remote attackers to execute arbitrary code via the "text color" field of the component "/admin/web config.php". Recommendations: For PHPMyWind version 5.6, consider disabling access to the...

CVE-2021-34715

A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to...

CVE-2021-30127

TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is only available on the local network" documentation. NOTE: manually editing /etc/upnp.json provides a partial but...

Design/Logic Flaw

TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is only available on the local network" documentation. NOTE: manually editing /etc/upnp.json provides a partial but...

CVE-2021-30127

CVE-2021-30127 affects TerraMaster F2-210 devices. The root issue is UPnP-enabled exposure of the admin web server on TCP port 8181 to the Internet, contrary to local-network expectations. Consequence is potential unauthorized access due to outward-facing admin interface. A partial, undocumented ...

Grandstream GRP261x VoIP phone 访问控制错误漏洞

The Grandstream GRP261x VoIP phone is an IP phone from Grandstream USA. A carrier-grade IP phone designed for large-scale deployments. A security vulnerability exists in the Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 that allows authentication bypass in its administration web...

VulnCheck KEV: CVE-2020-8218

A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

CVE-2020-8260

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction...

CVE-2020-8260

Pulse Connect Secure (PCS) vulnerable

CVE-2020-8255

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerability is fixed using encrypted URL blacklisting that prevents these messages...

CVE-2020-8260

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2020-8243

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution...

CVE-2020-8256

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

Xxe

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

CVE-2020-8243

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution. Recent assessments: wvu-r7 at October 07, 2020 10:52pm UTC reported: Oh dear, another Pulse Secure vuln. Let’s break this...

CVE-2020-8243

CVE-2020-8243 affects Pulse Connect Secure, specifically the admin web interface prior to 9.1R8.2. An authenticated attacker can upload a custom template to achieve arbitrary code execution via the admin UI. The CVSSv3 base score is 7.2 (High) with network access, low attack complexity, and high ...

CVE-2020-8256

CVE-2020-8256 is a vulnerability in the Pulse Connect Secure admin web interface prior to 9.1R8.2 that allows an authenticated attacker to read arbitrary files via XML External Entity (XXE) through Pulse Collaboration. The issue is confirmed across multiple sources (Red Hat advisory, Nessus plugi...

CVE-2019-1888

CVE-2019-1888 affects Cisco Unified Contact Center Express (Unified CCX). Vulnerability in the Administration Web Interface allows an authenticated attacker with valid Administrator credentials to upload arbitrary files containing OS commands, which will be executed on the underlying system. The ...

Pulse Connect Secure < 9.1R8 (SA44516)

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is prior to 9.1R8. It is, therefore, affected by multiple vulnerabilities: - An attacker can bypass the Google TOTP, if the primary credentials are exposed to attacker CVE-2020-8206. - An...