CVE-2022-46165 Cross-site Scripting (XSS) in Web GUI in syncthing

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and...

Design/Logic Flaw

DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references IDOR. This could result in a user deleting another user's dashboard or messages or interfering with the...

Contec CONPROSYS HMI System 跨站脚本漏洞

Contec CONPROSYS HMI System is an HTML5-based HMI Human Machine Interface/SCADA Supervisory Control and Data Acquisition software product from Contec Japan. A security vulnerability exists in Contec CONPROSYS HMI System versions prior to 3.5.3, which stems from a cross-site scripting vulnerabilit...

The vulnerability in the web interface of the Cisco Prime Collaboration Deployment software allows a attacker to disclose sensitive information, alter the appearance of the web page, and perform phishing attacks as well as “drive-down” attacks.

The vulnerability in the Cisco Prime Collaboration Deployment software’s web interface exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to disclose sensitive information, alter the appearance of the website, and perfor...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to delete arbitrary files.

The vulnerability in the web interface for managing Cisco Identity Services Engine ISE platforms relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to delete arbitrary files using a specially created HTTP request...

The vulnerability in the web interface for managing microprogramming software on Cisco Small Business Series switches allows a perpetrator to gain unauthorized access to protected information.

The vulnerability in the web interface for managing microprogrammed software in Cisco Small Business Series switches is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...

CVE-2023-20077

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

Cisco Small Business 安全漏洞

Cisco Small Business is a switch from Cisco. A security vulnerability exists in Cisco Small Business Series Switches that stems from multiple vulnerabilities in the web-based user interface. An unauthenticated, remote attacker could exploit this vulnerability to cause a denial of service DoS or...

The vulnerability of the configuration saving function in the web interface of D-Link DWL-2600AP wireless access points allows a intruder to execute arbitrary commands.

The vulnerability of the configuration saving function in D-Link DWL-2600AP wireless access points related to the lack of measures taken to neutralize special elements used in the operating system’s processing of the commands admin.cgi?action=configsave and downloadServerip. Exploiting this...

CVE-2023-30510

A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possib...

The web interface of Netgear’s SRX5308 router software has vulnerabilities that allow attackers to perform cross-site scripting attacks.

The vulnerability in the web interface of Netgear SRX5308 integrated software routers exists because measures are not taken to protect the structure of the web page when processing the argument smtpServer.fromAddr. Exploiting this vulnerability allows a malicious actor to perform cross-site...

CVE-2023-31164

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL...

PT-2023-23188 · Schweitzer Engineering Laboratories · Sel Rtac

Name of the Vulnerable Software and Affected Versions: Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC affected versions not specified Description: An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue in the SEL RTAC Web Interfac...

Schweitzer Engineering Laboratories Real Time Automation Controller 跨站脚本漏洞

Schweitzer Engineering Laboratories Real Time Automation Controller SEL RTAC is a powerful and versatile automation platform from Schweitzer Engineering Laboratories. A security vulnerability exists in the Schweitzer Engineering Laboratories Real Time Automation Controller that originates from...

Schweitzer Engineering Laboratories Real Time Automation Controller 跨站脚本漏洞

Schweitzer Engineering Laboratories Real Time Automation Controller SEL RTAC is a powerful and versatile automation platform from Schweitzer Engineering Laboratories. A security vulnerability exists in the Schweitzer Engineering Laboratories Real Time Automation Controller that originates from...

The vulnerability in the web interface for managing Netgear SRX5308 microprogramming software routers allows attackers to perform cross-site scripting attacks.

The vulnerability in the web interface for managing Netgear SRX5308 microprogramming software routers is related to insufficient protection of the web page structure when processing the Login.userAgent parameter. Exploiting this vulnerability allows a remote attacker to perform cross-site scripti...

The web interface of Netgear’s SRX5308 router software has vulnerabilities that allow attackers to carry out cross-site scripting attacks.

The vulnerability in the web interface of Netgear SRX5308 integrated software routers exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack by sending a specially crafted HTTP...

Schweitzer Engineering Laboratories Real Time Automation Controller 跨站脚本漏洞

Schweitzer Engineering Laboratories Real Time Automation Controller SEL RTAC is a powerful and versatile automation platform from Schweitzer Engineering Laboratories. A security vulnerability exists in the Schweitzer Engineering Laboratories Real Time Automation Controller that originates from...

Schweitzer Engineering Laboratories Real Time Automation Controller 输入验证错误漏洞

Schweitzer Engineering Laboratories Real Time Automation Controller SEL RTAC is a powerful and versatile automation platform from Schweitzer Engineering Laboratories. A security vulnerability exists in Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC that originates fr...