PT-2019-6313

Name of the Vulnerable Software and Affected Versions Citrix SD-WAN versions 10.2.x through 10.2.2 NetScaler SD-WAN versions 10.0.x through 10.0.7 Description The issue is related to improper input validation in the management interface component of NetScaler SD-WAN and Citrix SD-WAN, which can b...

D-Link DCS-1100 and D-Link DCS-1130 Cross-Site Request Forgery Vulnerabilities (CNVD-2019-23334)

The D-Link DCS-1100 and the D-Link DCS-1130 are both network cameras from Taiwan, China-based AUO D-Link. A cross-site request forgery vulnerability exists in the D-Link DCS-1100 and DCS-1130. An attacker can exploit the vulnerability by sending simple UDP packets to access the management interfa...

Cross site scripting

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

CVE-2019-1930 Cisco Firepower Management Center RSS Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

CVE-2019-1930

Cisco Firepower Management Center (FMC) RSS dashboard web interface is affected by multiple cross-site scripting (XSS) vulnerabilities due to insufficient validation of user input. An unauthenticated, remote attacker could lure a user into clicking a crafted link, potentially executing arbitrary ...

CVE-2019-1931 Cisco Firepower Management Center RSS Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

UBUNTU-CVE-2019-10104

In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration for Tomcat, Jetty, Resin, or CloudBees with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of...

Cisco Firepower Management Center RSS Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

CVE-2017-11578

CVE-2017-11578 affects the Blipcare wireless blood pressure monitor. The device exposes its web management interface over plain HTTP (non-SSL), allowing an attacker on the same wireless network to conduct a MITM and sniff the user’s Wi‑Fi credentials. The impact is disclosure of credentials witho...

Default credentials

An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be...

Cross site scripting

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to...

CVE-2017-8407

CVE-2017-8407 affects D-Link DCS-1130 network cameras. The issue is a lack of cross-site request forgery protection in the web management interface, allowing an attacker to trick a logged-in user into changing the user’s administrative password. The vulnerability’s impact is partial confidentiali...

CVE-2017-8407

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to...

CVE-2017-8406: Cross-Site Request Forgery (CSRF)

An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In thi...

CVE-2017-8407: Cross-Site Request Forgery (CSRF)

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to...

PT-2019-7897

Name of the Vulnerable Software and Affected Versions Blipcare device affected versions not specified Description The Blipcare device, a Wireless Blood pressure monitor, allows connection to its web management interface using a non-SSL connection and the plain text HTTP protocol. Users provide...

PT-2019-8630

Name of the Vulnerable Software and Affected Versions D-Link DCS-1130 devices affected versions not specified Description An issue was discovered where the device does not implement any cross-site request forgery protection mechanism. This allows an attacker to trick a user who is logged in to th...

CVE-2019-1621

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacke...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacke...

CVE-2019-1620 Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could...