PT-2026-4740

Name of the Vulnerable Software and Affected Versions exos 9300 server affected versions not specified Description A SOAP API is reachable on port 8002 on the exos 9300 server without requiring authentication. Network access to the server allows for actions such as creating arbitrary access log...

Dormakaba Exos 9300 security vulnerabilities

The Dormakaba Exos 9300 is an access control and security management system developed by the American company Dormakaba. The Dormakaba Exos 9300 has a security vulnerability, which stems from the presence of multiple hardcoded credentials. This vulnerability could allow unauthorized access to the...

PT-2026-4744

A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application d9sysdef.exe. Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM...

PT-2026-4741

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically...

CVE-2023-43121

A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine EXOS before 32.5.1.5, before 22.7, and before 31.7.2 allows attackers to read arbitrary files...

EUVD-2017-5834

Malware in sbrugna...

EUVD-2017-5831

Malware in sbrugna...

EUVD-2017-5833

Malware in sbrugna...

EUVD-2017-5835

Malware in sbrugna...

EUVD-2017-5830

Malware in sbrugna...

EUVD-2017-5832

Malware in sbrugna...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

CVE-2020-18305

Extreme Networks EXOS is affected by a Web GUI URL access restriction flaw in versions prior to 22.7 and prior to 30.2. The root cause is that the Web GUI does not correctly restrict URL access, enabling access to sensitive information and potential privilege escalation. Affected products: Extrem...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

PT-2024-10784 · Extreme Networks · Extreme Networks Exos

Name of the Vulnerable Software and Affected Versions: Extreme Networks EXOS versions prior to 22.7 Extreme Networks EXOS versions prior to 30.2 Description: The issue is related to the Web GUI of Extreme Networks EXOS, which fails to restrict URL access. This allows attackers to access sensitive...

Extreme Networks EXOS Security Vulnerability

Extreme Networks EXOS is a software or network operating system used in a network switch from Extreme Networks USA. Extreme Networks EXOS has a security vulnerability that originates when an attacker sends a malicious BGP update message packet that can trigger a denial of service...

CVE-2023-43119

An Access Control issue discovered in Extreme Networks Switch Engine EXOS before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server...

CVE-2023-43118

Cross Site Request Forgery CSRF vulnerability in Chalet application in Extreme Networks Switch Engine EXOS before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Chalet application in Extreme Networks Switch Engine EXOS before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API...