9281 matches found
CVE-2018-8006
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...
Cisco Unity Connection Bulk Administration Tool Resource Management Error Vulnerability
Cisco Unity Connection UC is a voice messaging platform from Cisco, Inc. that utilizes voice commands to make calls or listen to messages in a "hands-free" manner. The platform utilizes voice commands to make calls or listen to messages in a "hands-free" manner.Bulk Administration Tool BAT is one...
CVE-2018-8006: Improper Neutralization of Input During Web Page Generation
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...
PT-2018-18376
Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ versions 5.0.0 through 5.15.5 Description: A cross-site scripting issue was found in the web-based administration console, specifically on the queue.jsp page. The root cause is improper data filtering of the QueueFilter...
CVE-2018-0059: Improper Neutralization of Input During Web Page Generation
A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...
CVE-2018-15396
A vulnerability in the Bulk Administration Tool BAT for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service DoS condition. The vulnerability exists because the affected software does not restrict the maximum size of...
CVE-2018-15396 Cisco Unity Connection File Upload Denial of Service Vulnerability
A vulnerability in the Bulk Administration Tool BAT for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service DoS condition. The vulnerability exists because the affected software does not restrict the maximum size of...
CVE-2018-15396 Cisco Unity Connection File Upload Denial of Service Vulnerability
A vulnerability in the Bulk Administration Tool BAT for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service DoS condition. The vulnerability exists because the affected software does not restrict the maximum size of...
CVE-2018-15396: Uncontrolled Resource Consumption
A vulnerability in the Bulk Administration Tool BAT for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service DoS condition. The vulnerability exists because the affected software does not restrict the maximum size of...
PT-2018-13011
Name of the Vulnerable Software and Affected Versions Cisco Unity Connection affected versions not specified Description A vulnerability in the Bulk Administration Tool BAT for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a deni...
Cisco Unity Connection File Upload Denial of Service Vulnerability
A vulnerability in the Bulk Administration Tool BAT for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service DoS condition. The vulnerability exists because the affected software does not restrict the maximum size of...
HPE Integrated Lights Out 4 and 5 for Gen Denial of Service Vulnerability
HPE Integrated Lights-Out 4 iLO 4 and Integrated Lights-Out 5 iLO 5 are both embedded server management technologies from Hewlett Packard Enterprise HPE that use an integrated remote management port to monitor and maintain the server operation, remote control of the server, and more through an...
CVE-2018-15611
A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1...
Design/Logic Flaw
A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1...
PT-2018-13117
Name of the Vulnerable Software and Affected Versions Avaya Aura Communication Manager versions 6.3.x through 7.1.3.0 Avaya Aura Communication Manager version 7.1.3.1 is not affected, so the range is prior to 7.1.3.1 for 7.x versions. Description A vulnerability in the local system administration...
CVE-2018-15611: Improper Access Control
A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1...
Threats posed by using RATs in ICS
While conducting audits, penetration tests and incident investigations, we have often come across legitimate remote administration tools RAT for PCs installed on operational technology OT networks of industrial enterprises. In a number of incidents that we have investigated, threat actors had use...
Simple POS SQL Injection Vulnerability
Simple POS is a sales system based on PHP and jQuery. The system supports tax calculation, printing receipts and supports barcode scanning. An SQL injection vulnerability exists in the administration panel in Simple POS version 4.0.24. A remote attacker can exploit the vulnerability by sending th...
Code injection
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code...
