CVE-2022-37913

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a...

CVE-2022-37915

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands o...

PT-2022-7010 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches affected versions not specified Description: The issue is related to improper resource management when processing traffic received on the management interface,...

PT-2022-6769 · Cisco · Cisco Broadworks Xtended Services Platform +3

Name of the Vulnerable Software and Affected Versions: Cisco BroadWorks CommPilot Application Software affected versions not specified Cisco BroadWorks Application Server AS affected versions not specified Cisco BroadWorks Xtended Services Platform XSP affected versions not specified BroadWorks...

CVE-2022-20822

Cisco Identity Services Engine (ISE) is affected via its web-based management interface. The root cause is insufficient validation of user-supplied input, enabling authenticated, remote attackers to read and delete files by sending crafted HTTP requests with path-sequence characters. Reported imp...

Vulnerability found in Cisco Identity Services Engine (ISE)

A vulnerability has been found in Cisco Identity Services Engine ISE. A malicious party could potentially exploit it to access and delete files stored on the vulnerable system. Successful exploitation requires authenticated access to the management interface required. It is good practice to make...

Linux kernel access control error vulnerability (CNVD-2022-74085)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable to an access control error. A remote attacker could retrieve sensitive information by connecting to a Web-based management interface and requesting URLs...

Cisco Identity Services Engine XSS (cisco-sa-ise-xss-twLnpy3M)

According to its self-reported version, Cisco Identity Services Engine is affected by a cross-site scripting XSS vulnerability due to insufficient input validation in the External RESTful Services ERS API. An attacker could exploit this vulnerability by persuading an authenticated administrator o...

CVE-2022-20959

A vulnerability in the External RESTful Services ERS API of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient input...

Cisco Identity Services Engine Unauthorized File Access Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to list, download, and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could explo...

PT-2022-6635 · Cisco · Cisco Identity Services Engine (Ise)

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE Software affected versions not specified Description: The issue is related to insufficient input validation in the External RESTful Services ERS API, which could allow an authenticated, remote attacker to...

CVE-2022-35844

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted argument...

FortiTester 操作系统命令注入漏洞

FortiTester is a Fortinet professional-based network traffic testing tool from FortiTester, Inc. A security vulnerability exists in FortiTester versions 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, and 7.0.0 through 7.1.0, which stems from improper invalidation of special elements used in OS command...

PT-2022-5312 · NetGear · Netgear R6220

Name of the Vulnerable Software and Affected Versions: Netgear R6220 version 1.1.0.114 1.0.1 Description: The issue is related to incorrect access control, resulting in a command injection vulnerability. It is also described as a lack of data cleaning measures at the management level, which can b...

Vulnerabilities fixed in Dell BIOS

Vulnerabilities have been fixed in the BIOS of Dell products. The vulnerabilities allow a malicious person to execute arbitrary execute arbitrary code under administrator privileges and manipulate data manipulate data. To exploit the vulnerabilities, an authenticated malicious party must have...

Cisco Smart Software Manager On-Prem Elevation of Privilege Vulnerability

Cisco Smart Software Manager On-Prem SSM On-Prem is a component of Cisco for Cisco product license management.An elevation of privilege vulnerability exists in previous versions of Cisco Smart Software Manager On-Prem 8-202206, which stems from insufficient protection of sensitive user informatio...

Vulnerability fixed in FortiGate and FortiProxy

Fortinet has fixed a vulnerability in FortiGate and FortiProxy. An unauthenticated malicious party could potentially exploit the vulnerability potentially exploit it to bypass authentication on the management interface and thus perform actions perform actions normally reserved for authenticated...

CVE-2022-37892

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a...

CVE-2022-37896

CVE-2022-37896 describes a reflected XSS vulnerability in Aruba InstantOS/ArubaOS 10 web management interfaces. A remote attacker could exploit input handling in the affected web UI to trigger script execution in a victim’s browser within the Aruba InstantOS/ArubaOS context. Affected versions inc...

Cisco Expressway Series and Cisco TelePresence Video Communication Server CSRF (cisco-sa-expressway-csrf-sqpsSfY6)

According to its self-reported version, Cisco Expressway-C and Cisco TelePresence VCS devices are affected by a vulnerability in their REST API that could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due...