CVE-2022-20902

Cisco Small Business RV110W, RV130, RV130W, and RV215W routers are affected by CVE-2022-20902, with multiple vulnerabilities in the web-based management interface that allow an authenticated attacker to execute arbitrary commands with root privileges or trigger device restarts (DoS). Root cause: ...

CVE-2022-20904 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20874 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20877 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20890

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20895

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20899

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

Cisco Identity Services Engine Administrator Password Lifetime Expiration Issue

An issue in the Password Policy settings of Cisco Identity Services Engine ISE could allow an administrator to use expired credentials to gain access to the web management interface. When the Password Lifetime setting for the administrator password policy is used to set the password to expire, th...

CVE-2022-30302

Multiple relative path traversal vulnerabilities CWE-23 in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web...

CVE-2022-26120

Multiple improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerabilities CWE-89 in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-26120

Multiple improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerabilities CWE-89 in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-30302

FortiDeceptor management interface (versions 1.0.0–3.2.x, 3.3.0–3.3.2, 4.0.0–4.0.1) is affected by CVE-2022-30302 due to a path traversal issue (input validation) that could allow a remote, authenticated attacker to retrieve and delete arbitrary files on the underlying filesystem via specially cr...

The management interface of the Fortinet FortiDeceptor is vulnerable, allowing attackers to gain read, modify, or delete access to data. This vulnerability enables attackers to manipulate security measures in response to external and internal security threats.

The vulnerability of the management interface for detecting and responding to external and internal security threats in Fortinet’s FortiDeceptor involves errors in processing the relative path to the catalog. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain read...

CVE-2021-26384

A malformed SMI System Management Interface command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources...

Command injection

A malformed SMI System Management Interface command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources...

CVE-2021-26384

CVE-2021-26384 is a vulnerability described as a malformed System Management Interface (SMI) command that can corrupt the SMI Trigger Info data structure, potentially enabling out-of-bounds memory reads/writes when an SMI is triggered. The AMD ADM/AMD-SB-1027 bulletin lists this CVE among others ...

Cisco Unified Communications Manager XSS (cisco-sa-cucm-xss-ksKd5yfA)

The version of Cisco Unified Communications Manager installed on the remote host is version 14 prior to 14SU2. It is, therefore affect by a cross-site scripting vulnerability XSS in the web-based management interface. An unauthenticated remote attacker can, with the action of an authorized user,...

wildfly-core: Invalid Sensitivity Classification of Vault Expression

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly...

Vulnerabilities fixed in IBM Tivoli Netcool Impact

Vulnerabilities have been fixed in IBM Tivoli Netcool Impact. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Spoofing Accessing sensitive data Accessing...

Fortinet FortiADC SQL Injection Vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. Fortinet FortiADC suffers from a SQL injection vulnerability that stems from insufficient cleanup of user-supplied data in the FortiADC management interface. A remote attacker could exploit this vulnerability to send a...