Cross site request forgery (csrf)

AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/localdel.cgi...

Design/Logic Flaw

AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."...

CVE-2015-8258

AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."...

CVE-2015-8255

AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/localdel.cgi...

CVE-2015-8258

AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."...

CVE-2015-8255

CVE-2015-8255 describes a Cross-Site Request Forgery vulnerability in AXIS Communications devices with a Web Interface. The embedded web app does not verify that a request is intentionally submitted by the user, enabling unauthorized state-changing actions. Documented impact includes CSRF-enabled...

CVE-2015-8258

CVE-2015-8258 affects AXIS Communications devices with firmware up to 5.80.x. The issue is a resource injection via the imagePath parameter in view.shtml, enabling XSS/Open Script Editor abuse to potentially cause a URL-based request to attacker-controlled content. The vulnerability arises from h...

CVE-2015-8258: Improper Neutralization of Special Elements in Output Used by a Downstream Component

AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."...

PT-2017-7366

Name of the Vulnerable Software and Affected Versions AXIS Communications products affected versions not specified Description The issue allows for CSRF, as demonstrated by API endpoints such as "admin/pwdgrp.cgi", "vaconfig.cgi", and "admin/local del.cgi". Recommendations At the moment, there is...

CVE-2015-8255: Cross-Site Request Forgery (CSRF)

AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/localdel.cgi...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability affects...

Sql injection

A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL...

CVE-2017-3886

A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL...

CVE-2017-3888

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability affects...

CVE-2017-3888

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability affects...

CVE-2017-3886

A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL...

CVE-2017-3888

The CVE-2017-3888 entry concerns Cisco Unified Communications Manager (CUCM) and describes a reflected cross-site scripting (XSS) vulnerability in the web-based management interface. The issue requires an authenticated administrator and can lead to script execution in the browser of a user access...

CVE-2017-3888

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability affects...

CVE-2017-3886

CVE-2017-3886 maps to Cisco Unified Communications Manager SQL Injection via the web interface. The vulnerability is triggered by an authenticated administrative user who can execute arbitrary SQL queries, potentially compromising confidentiality. Affected releases include 1.0(1.10000.10) and 11....

CVE-2017-3886

A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL...