CVE-2020-7113

A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP packets resulting in the compromise of some of ClearPass' service accounts. Resolution: Fixed in 6.7.10, 6.8.1, 6.9.0 and higher...

Design/Logic Flaw

A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in ClearPass by crafting HTTP packets. As a result of this attack, a possible complete cluster compromise might occur. Resolution: Fixed in...

Design/Logic Flaw

A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP packets resulting in the compromise of some of ClearPass' service accounts. Resolution: Fixed in 6.7.10, 6.8.1, 6.9.0 and higher...

CVE-2020-7113

The CVE-2020-7113 entry describes a vulnerability in Aruba Networks ClearPass (management interface) where an attacker can intercept and modify HTTP parameters, leading to compromise of some ClearPass service accounts. Affected versions include ClearPass Policy Manager prior to the fixed releases...

Important: Red Hat Security Advisory: ipmitool security update

An update for ipmitool is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

CVE-2020-3261

CVE-2020-3261 refers to a CSRF vulnerability in Cisco Mobility Express Software’s web-based management interface. The issue arises from insufficient CSRF protections, enabling an unauthenticated attacker to trick an active session user into performing arbitrary actions, including configuration ch...

CVE-2020-3261 Cisco Mobility Express Software Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based managemen...

CVE-2019-18375

The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console...

CVE-2019-18375

The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console...

Session Hijacking Vulnerability in ProxySG and ASG

Summary The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console. Affected Products Advanced Secure...

RHEL 6 : ipmitool (RHSA-2020:1331)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1331 advisory. The ipmitool packages contain a command-line utility for interfacing with devices that support the Intelligent Platform Management Interface IPMI...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3936 Unisoon UltraLog Express - SQL Injection

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

CVE-2020-3936 Unisoon UltraLog Express - SQL Injection

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

CVE-2019-16010 Cisco SD-WAN Solution vManage Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of...

Cisco Prime Collaboration Provisioning Information Disclosure (cisco-sa-prim-collab-disclo-FAnX4DKB)

According to its self-reported version, Cisco Prime Collaboration Provisioning is affected by an information disclosure vulnerability in the web-based management interface because replies from the web-based management interface include unnecessary server information. An unauthenticated, remote...

Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability (cisco-sa-prime-collab-xss-RjRCe9n7)

According to its self-reported version, Cisco Prime Collaboration Provisioning is affected by a cross-site scripting vulnerability in the web-based management interface due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could exploit this by persuading a us...

Cisco SD-WAN Solution vManage Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of...

Safescan Timemoto TA-8000 Series Path Traversal Vulnerability

The Safescan Timemoto TA-8000 is a TA-8000 series time and attendance system from the Dutch company Safescan. A path traversal vulnerability exists in Safescan Timemoto TA-8000 series version 1.0. A remote attacker can exploit this vulnerability to execute code with the help of the Management API...