The vulnerability of the VMware Workspace One Access application management platform, related to the administration console of VMware Identity Manager (vIDM), involves redirecting URLs to an unreliable website. This allows a malicious user to redirect users to any arbitrary URL address.

The vulnerability of the VMware Workspace One Access application management platform, as well as the VMware Identity Manager administration consoles, is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow a malicious actor to redirect...

Security Bulletin: "Administration Console can process body parameters that were submitted in the query" may affect IBM TXSeries for Multiplatforms

Summary "Administration Console can process body parameters that were submitted in the query" may affect IBM TXSeries for Multiplatforms. IBM TXSeries for Multiplatforms has addressed the applicable CVE and the fix has been provided as special fix uploaded in IBM Fix Central. Vulnerability Detail...

The vulnerability of the administration portal of Cisco Identity Services Engine (ISE) allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Cisco Identity Services Engine ISE administration portal is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Hitron Technologies CODA 操作系统命令注入漏洞

Hitron Technologies CODA-5310 is a wireless router. The Hitron Technologies CODA-5310 suffers from a remote command execution vulnerability that can be exploited by an attacker to perform a command injection attack using the administration page to execute arbitrary system commands, manipulate the...

PT-2023-17903 · WordPress · Fast & Effective Popups & Lead-Generation

Name of the Vulnerable Software and Affected Versions: Fast & Effective Popups & Lead-Generation for WordPress plugin versions prior to 2.1.4 Description: The issue concerns the concatenation of user input into an SQL query without proper escaping in the plugin's report API endpoint. This could...

Openfire administration console authentication bypass

[email protected] reports: Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configure...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

Liferay portal unauthorized access to objects via OAuth 2 scope

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope...

CVE-2023-33946

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope...

CVE-2023-33946

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope...

PT-2023-24588 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.4 through 7.4.3.48 Liferay DXP 7.4 before update 49 Description: The issue allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope...

CVE-2022-41221

The CVE-2022-41221 issue affects OpenText Archive Center Administration client versions up to 21.2, where authenticated users can upload XML files that are not properly validated, enabling XXE attacks that may lead to data exfiltration or localized DoS. Root cause: insufficient XML validation. Mi...

Linksys E2000 命令注入漏洞

The Linksys E2000 is a wireless router from Linksys, Inc. A command injection vulnerability exists in the Linksys E2000 1.0.06 firmware version, which stems from the fact that if an attacker gains web administrative privileges, he/she can inject commands into the post request parameters WLattenbb...

PT-2023-22437 · Exelysis · Exelysis Unified Communication Solution

Name of the Vulnerable Software and Affected Versions: Exelysis Unified Communication Solution EUCS version 1.0 Description: A Cross Site Scripting issue allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page. Recommendations: For Exelysis Unified Communicati...

The vulnerability of the HNAP1 protocol implementation in D-Link DIR-2640-US router microsoftware allows a attacker to circumvent security restrictions and execute arbitrary code.

The vulnerability of the HNAP1 protocol implementation in the D-Link DIR-2640-US router microprogramming system is related to insufficient validation of the string entered by the user before it is used to execute system calls when processing the DestNetwork parameter. Exploiting this vulnerabilit...

Teledyne FLIR FLIR-DVTEL camera 安全漏洞

Teledyne FLIR FLIR-DVTEL camera is a series of camera surveillance devices from Teledyne FLIR USA. A security vulnerability exists in Teledyne FLIR FLIR-DVTEL camera that originates from an attacker being able to remotely execute arbitrary code via a crafted request to the device's administration...

CVE-2023-27823

An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials...

CVE-2023-27823

An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials...

CVE-2023-27823

An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials...

CVE-2023-27823

The CVE-2023-27823 entry describes an authentication bypass in Optoma 1080PSTX C02 firmware that enables a network-attached attacker to reach the administration console without valid credentials. Public details indicate the bypass can be achieved by setting the atop cookie to 1, effectively bypas...