PT-2019-2088 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the detection engine of Cisco Adaptive Security Applian...

CVE-2019-11489

CVE-2019-11489 affects SimplyBook.me Enterprise (older releases) where the Administrative Management Interface enforces incorrect access control. Affected: authenticated low-privilege users; vulnerability allows elevation to full admin rights via a crafted HTTP PUT to a /v2/rest/ endpoint with mo...

CVE-2019-7727

In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol by using the JMX connector. The observed affected TC...

Management Interface Exposed

github.com/heketi/heketi does not require authentication to its management interface. This allows a remote attacker to gain unauthenticated access to management functions and perform further attacks against the application...

Design/Logic Flaw

The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2...

Default configuration

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11...

CVE-2015-1320

The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2...

CVE-2015-1320

The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2...

Juniper Junos SRX crafted packets destined to fxp0 denial of service (JSA10927)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability in the management interface due to buffer space exhaustion. An unauthenticated, adjacent attacker can exploit this issue, via crafted packets destined to the management...

CVE-2019-1722

A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due ...

CVE-2019-1802

Cisco Firepower Management Center (FMC) is affected by CVE-2019-1802: an authenticated, remote attacker can exploit a cross-site scripting (XSS) vulnerability due to insufficient validation of input in the web-based management interface. A successful exploit requires a user to view a report conta...

CVE-2019-1802 Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected system. The vulnerability is due to...

CVE-2019-1722 Cisco Expressway Series and Cisco TelePresence Video Communication Server Cross-Site Request Forgery Vulnerability

A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due ...

CVE-2019-1719 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based guest portal of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied...

PT-2019-2589 · Red Hat · Openshift Container Platform +1

Name of the Vulnerable Software and Affected Versions: Heketi versions as shipped with Openshift Container Platform 3.11 Description: The issue is related to the lack of an authentication procedure in the standard settings of Heketi, a network software tool. This could allow a remote attacker to...

Cisco Wireless LAN Controller Software Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on the device with the privileges of the user, including modifying...

The vulnerability of the interface driver for IPMI kernel-based operating system Linux allows a perpetrator to cause maintenance failures.

The vulnerability of the driver for the IPMI platform’s management interface driver/char/ipmi/ipmimsghandler.c code in Linux operating systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to trigger a service failure through the IP...

Cisco RV325 < 1.4.2.22 Multiple Vulnerabilities

Binary data 700567.prm...

Verizon Wireless Fios Quantum Gateway (G1100) Authorization Issues Vulnerability

The Verizon Wireless Fios Quantum Gateway G1100 is a wireless router from Verizon Wireless. An authorization issue vulnerability exists in the Verizon Fios Quantum Gateway G1100 using firmware version 02.01.00.05, which arises from a lack of or insufficiently strong authentication measures in a...

Cisco RV130W Routers - Management Interface Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework linux/armle/meterpreter/bindtcp - segfault linux/armle/meterpreter/reversetcp - segfault linux/armle/meterpreterreversehttp - works linux/armle/meterpreterreversehttps -...