CVE-2017-2832

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in...

CVE-2017-2832

Summary : CVE-2017-2832 affects the Foscam C1 Indoor HD Camera via the CGIProxy.fcgi Account Deletion Command Injection vulnerability. The attacker must have an administrator account to exploit. During delAccount, the code path extracts usrName and passes it to a function that ultimately executes...

CVE-2017-2833: Improper Neutralization of Special Elements used in a Command

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the...

CVE-2018-0259

The CVE-2018-0259 issue affects Cisco MATE Collector’s web-based management interface, arising from inadequate CSRF protections. An unauthenticated, remote attacker could induce a logged-in user to click a malicious link, enabling the attacker to perform arbitrary actions on the device via the us...

CVE-2018-0259

A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the...

CVE-2018-7920

Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the...

CVE-2018-0259: Cross-Site Request Forgery (CSRF)

A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the...

Huawei Denial of Service Vulnerability in Multiple AR Series Products

The AR1200, AR160, and AR3200 are a series of enterprise routers from China's Huawei. A denial of service vulnerability exists in several of Huawei's AR series products. Due to improper implementation of the ACL mechanism, a remote attacker can send a TCP request to the management interface, and ...

Cisco MATE Collector Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the...

Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability

A vulnerability in the Login screen of the Clientless SSL VPN WebVPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Th...

CVE-2018-8802

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

CVE-2018-8802: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

OpenVPN Cross-Site Scripting Vulnerability

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

Input validation

DISPUTED A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensiti...

DEBIAN-CVE-2018-7544

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...

CVE-2018-7544

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...

CVE-2018-7544

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...

CVE-2018-7544

Removed by vendor...

CVE-2018-7544

CVE-2018-7544 affects OpenVPN up to 2.4.5 where the management interface, if exposed over TCP without authentication and no clients connected, allows cross-protocol scripting via XMLHttpRequest to localhost:23000. An attacker can issue arbitrary management commands, exfiltrate data, or trigger a ...

CVE-2018-7544: Use of Externally-Controlled Format String

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...