CVE-2018-0343: Improper Access Control

A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary code with vmanage user privileges or cause a denial of service DoS condition on an affected system. The vulnerability is due to insufficient...

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Hidden Features

Summary The new IPn4Gb provides a rugged, industrial strength wireless solution using the new and ultra fast 4G LTE cellular network infrastructure. The IPn4Gb features integrated Firewall, IPSec / VPN & GRE Tunneling, IP/MAC Access Control Lists. The IPn4Gb can transport critical data to and fro...

CVE-2018-14324

The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a...

CVE-2018-0366

CVE-2018-0366 affects Cisco Web Security Appliance (WSA) and concerns a reflected cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, resulting in arb...

Microhard Systems 3G/4G Cellular Ethernet And Serial Gateway Hidden Features

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Hidden Features Vendor: Microhard Systems Inc. Product web page: http://www.microhardcorp.com Affected version: IPn4G 1.1.0 build 1098 IPn3Gb 2.2.0 build 2160 IPn4Gb 1.1.6 build 1184-14 IPn4Gb 1.1.0 Rev 2 build 1090-2 IPn4Gb 1.1.0 Rev 2...

CVE-2018-0366: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

Cisco Web Security Appliance Cross-Site Scripting Vulnerability (CNVD-2018-13760)

Cisco Web Security Appliance WSA is a set of Web security appliances from Cisco USA. The appliance provides SaaS-based access control, real-time network reporting and tracking, and the development of security policies. A cross-site scripting vulnerability exists in the web-based management...

Cisco Web Security Appliance Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

Security Bulletin: Vulnerability in IBM Rational ClearCase (GSKit component) with potential for TLS Attack (CVE-2013-0169)

Summary The IBM GSKit component used in Rational ClearCase is susceptible to a Transport Layer Security protocol used in HTTPS vulnerability known as "Lucky Thirteen." The vulnerability might allow remote attackers to conduct distinguishing and plain-text recovery attacks by statistically analyzi...

Citrix NetScaler Multiple Vulnerabilities (CTX232161)

The remote Citrix NetScaler device is affected by multiple vulnerabilities in the Application Delivery Controller ADC and the Gateway Management Interface. Please refer to advisory CTX232161 for more information. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid110903;...

PAN-OS Local Elevation of Privilege Vulnerability (CNVD-2018-13467)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in the PAN-OS management web interface page in Palo Alto Networks PAN-OS. An attacker could exploit this vulnerability by manipulating HTML to access...

Siemens SICLOCK TC Product Bypass Certification Vulnerability (CNVD-2018-12506)

The SICROCK product line offers components for synchronizing plant and system time. An authentication bypass vulnerability exists in Siemens SICLOCK TC products. An attacker with administrative access to the device management interface could lock out legitimate users...

CVE-2018-9242

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters...

CVE-2018-4856

The CVE-2018-4856 issue affects Siemens SICLOCK TC100 and TC400 (All versions). Concretely, an attacker with administrative access to the device management interface can lock out legitimate users, requiring manual interaction to restore access. Some connected sources describe an authentication by...

Information Disclosure in the PAN-OS Management Web Interface

A local privilege escalation vulnerability exists in the PAN-OS management web interface that allows the administrator to access the password hashes of local users by manipulating the HTML markup. Ref. PAN-91564; CVE-2018-9334 Successful exploitation of this issue requires the attacker to be...

Information Disclosure in the PAN-OS Management Web Interface

A local privilege escalation vulnerability exists in the PAN-OS management web interface that allows the administrator to access the password hashes of local users by manipulating the HTML markup. Ref. PAN-91564; CVE-2018-9334 Successful exploitation of this issue requires the attacker to be...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS session browser. Ref. PAN-93244; CVE-2018-9335 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML. An attacker would need to successfully authenticate prior to exploiting this issue. This...

Local Privilege Escalation in Management Web Interface

A vulnerability exists in the Management web interface that could allow local privilege escalation. The Management web interface does not properly validate specific request parameters, which can potentially allow deletion of files in the system. Ref. PAN-90954; CVE-2018-9242 Successful exploitati...

Cisco Unified Communications Domain Manager Cross-Site Request Forgery Vulnerability

Cisco Unified Communications Domain Manager CUCDM is the United States Cisco Cisco company developed a dedicated unified communications solutions in the call processing components. The component has scalable, distributable, highly available enterprise voice-over-IP call processing capabilities. A...

Cisco Meeting Server Session Fixation Vulnerability

Cisco Meeting Server formerly known as Acano Conferencing Server, CMS is the United States Cisco Cisco company's set of audio and video conferencing server software. A session fixation vulnerability exists in the session identifier management feature of the web-based management interface in Cisco...