PT-2025-32191 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Description: A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This issue is...

Cisco Identity Services Engine (cisco-sa-ise_xss_acc_cont-YsR4uT4U)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of...

(Pwn2Own) QNAP QHora-322 Improper Restriction of Communication Channel to Intended Endpoints Vulnerability

This vulnerability allows network-adjacent attackers to access the management interface on affected installations of QNAP QHora-322 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the management interface. The issue resul...

The vulnerability of the geteasycfg function (/cgi-bin/lighttpd.cgi) of the Web Management Interface component of the microprogramming-based router LB-LINK BL-AC3600 allows a attacker to disclose protected information.

The vulnerability of the geteasycfg function /cgi-bin/lighttpd.cgi of the Web Management Interface component of the microprogramming-based router LB-LINK BL-AC3600 is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to disclose sensitiv...

IROAD Dashcam FX2 安全漏洞

IROAD Dashcam FX2 is a car recorder from IROAD, a South Korean company. A security vulnerability exists in IROAD Dashcam FX2, which stems from a device pairing bypass that allows an attacker to directly access the management interface after accessing it with a default password...

DEBIAN-CVE-2025-38412

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content...

Cisco Unified Intelligence Center Arbitrary File Upload (cisco-sa-cuis-file-upload-UhNEtStm)

The version of Cisco Unified Intelligence Center installed on the remote host is prior to tested version. It is, therefore, affected by an arbitrary file upload vulnerability as referenced in the cisco-sa-cuis-file-upload-UhNEtStm advisory: - A vulnerability in the web-based management interface ...

CVE-2025-40599

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution...

Vulnerabilities fixed in Citrix NetScaler ADC and NetScaler Gateway

Citrix has fixed vulnerabilities in NetScaler ADC and NetScaler Gateway. The vulnerability with reference CVE-2025-5777 involves an Out-of-Bounds Read. This vulnerability arises from insufficient input validation in systems configured as Gateway services. These include VPN virtual servers, ICA...

CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the...

CVE-2025-20288

CVE-2025-20288 describes a SSRF vulnerability in Cisco Unified Intelligence Center’s web-based management interface. The issue stems from improper input validation of specific HTTP requests, allowing an unauthenticated, remote attacker to cause the affected device to issue arbitrary network reque...

CVE-2025-20274

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management...

Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack through an affected device. This vulnerability is due to improper input validation for specific HTTP...

CVE-2025-52689

CVE-2025-52689 affects Alcatel-Lucent OmniAccess Stellar Wi‑Fi APs (e.g., Stellar series) via a weak session ID check in the web management interface. The root cause allows an unauthenticated attacker to spoof a login and obtain a valid administrator session ID, potentially letting the attacker m...

CVE-2025-52688 Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface

Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point...

CVE-2025-7565

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possib...

CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2025.2.86069,...

CVE-2025-52377

CVE-2025-52377 affects Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and earlier. The vulnerability is in the web management interface’s ping/traceroute endpoints (/web/um_ping_set.cgi) where the Ping_host_text input is not properly sanitized before it reaches the underlying system comma...

CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the...