CVE-2023-26057

An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters su...

CVE-2022-45291

CVE-2022-45291 affects the PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS 2012_lts. The vulnerability enables remote code execution by injecting PHP into settings.php, with exploitation paths including PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_ea...

PT-2023-14639 · Unknown · Pws Personal Weather Station Dashboard

Name of the Vulnerable Software and Affected Versions: PWS Personal Weather Station Dashboard PWS Dashboard version 2012 lts Description: The issue allows remote code execution by injecting PHP code into settings.php. Attacks can use the "PWS printfile.php", "PWS frame text.php", "PWS...

PT-2023-21543 · Hewlett Packard · Hpe Oneview +1

Name of the Vulnerable Software and Affected Versions: HPE OneView and HPE OneView Global Dashboard appliance affected versions not specified Description: The issue concerns HPE OneView and HPE OneView Global Dashboard appliance dumps potentially exposing authentication tokens. There is no...

CVE-2023-26061

An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can create a script to inject XSS. Input validation was missing during creation of a scheduled task. For an external attacker, it is very difficult to exploit this,...

CVE-2023-26061

An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can create a script to inject XSS. Input validation was missing during creation of a scheduled task. For an external attacker, it is very difficult to exploit this,...

Input validation

An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can create a script to inject XSS. Input validation was missing during creation of a scheduled task. For an external attacker, it is very difficult to exploit this,...

Stored XSS in the module named "Dashboard"

Description I tested the demo site you provided. I see that there is an XSS vulnerability. I hope you can check and provide a fix as soon as possible. Proof of Concept link video PoC https://drive.google.com/file/d/19lzyLY20fn0WdgRxsIrIRSfkrq36j7s5/view?usp=sharing Steps 1.Login as administrator...

CVE-2023-26061

Nokia NetAct

Help Desk WP <= 1.2.0 - Editor+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks. 1. Using a user with Editor Role privileges, go to the support page assigned for the Help Desk WP Plugin. 2. Click on "Add New Ticket", and fill t...

PT-2023-8600 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.2 XWiki Platform versions prior to 15.0-rc-1 Description: The issue exists due to the lack of measures to neutralize...

CVE-2023-28085

An HPE OneView Global Dashboard OVGD appliance dump may expose OVGD user account credentials...

CVE-2023-28085

An HPE OneView Global Dashboard OVGD appliance dump may expose OVGD user account credentials...

Command injection

An HPE OneView Global Dashboard OVGD appliance dump may expose OVGD user account credentials...

CVE-2023-28085

CVE-2023-28085 relates to HPE OneView Global Dashboard (OVGD). The connected documents indicate that an OVGD appliance dump may expose OVGD user account credentials. Key details from the sources show a local attack vector with low privileges required, and a high confidentiality impact, yielding a...

CVE-2023-28085

An HPE OneView Global Dashboard OVGD appliance dump may expose OVGD user account credentials...

CVE-2023-28085

An HPE OneView Global Dashboard OVGD appliance dump may expose OVGD user account credentials...

Hewlett Packard Enterprise OneView Global Dashboard 安全漏洞

Hewlett Packard Enterprise OneView Global Dashboard OVGD is a suite of dashboard solutions from Hewlett Packard Enterprise USA. A security vulnerability exists in Hewlett Packard Enterprise OneView Global Dashboard that stems from a device dump that could expose OVGD user account credentials...

Security Bulletin: DataPower Operations Dashboard vulnerable to multiple CVEs

Summary DataPower Operations Dashboard has addressed the following CVEs Vulnerability Details CVEID:CVE-2022-41881 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a StackOverflowError in HAProxyMessageDecoder. By sending a specially-crafted message, a remote attacker could...

ChatBot < 4.4.9 - Unauthenticated Stored XSS

The plugin does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard curl -X POST --data 'qcbotstrweight=" style=animation-name:rotation...