Huawei Denial of Service Vulnerability in Multiple AR Series Products

The AR1200, AR160, and AR3200 are a series of enterprise routers from China's Huawei. A denial of service vulnerability exists in several of Huawei's AR series products. Due to improper implementation of the ACL mechanism, a remote attacker can send a TCP request to the management interface, and ...

Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability

A vulnerability in the Login screen of the Clientless SSL VPN WebVPN portal of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Th...

Cisco MATE Collector Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the...

PT-2018-18321

Name of the Vulnerable Software and Affected Versions: Huawei AR1200 version V200R006C10SPC300 Huawei AR160 version V200R006C10SPC300 Huawei AR200 version V200R006C10SPC300 Huawei AR2200 version V200R006C10SPC300 Huawei AR3200 version V200R006C10SPC300 Description: The issue is related to imprope...

PT-2018-4308

Name of the Vulnerable Software and Affected Versions Unify OpenStage SIP and OpenScape Desk Phone IP V3 devices versions prior to R3.32.0 Description The issue concerns a CRLF injection vulnerability in the web-based management interface of the affected devices. This vulnerability allows remote...

PT-2018-4300

Name of the Vulnerable Software and Affected Versions Unify OpenStage SIP and OpenScape Desk Phone IP V3 versions prior to R3.32.0 Description The issue concerns the web-based management interface in the affected devices, which generates session cookies with insufficient entropy. This makes it...

CVE-2018-8802

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

CVE-2018-8802: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

PT-2018-18629

Name of the Vulnerable Software and Affected Versions ePortal Manager affected versions not specified Description A SQL injection issue in the management interface of ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters. Recommendations At the momen...

OpenVPN Cross-Site Scripting Vulnerability

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

Input validation

DISPUTED A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensiti...

DEBIAN-CVE-2018-7544

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...

CVE-2018-7544

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...

CVE-2018-7544

CVE-2018-7544 affects OpenVPN up to 2.4.5 where the management interface, if exposed over TCP without authentication and no clients connected, allows cross-protocol scripting via XMLHttpRequest to localhost:23000. An attacker can issue arbitrary management commands, exfiltrate data, or trigger a ...

CVE-2018-7544

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...

CVE-2018-7544

Removed by vendor...

CVE-2018-7544: Use of Externally-Controlled Format String

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive...

PT-2018-18148 · Openvpn +3 · Openvpn +3

Name of the Vulnerable Software and Affected Versions: OpenVPN versions through 2.4.5 Description: A cross-protocol scripting issue was discovered in the management interface of OpenVPN. When this interface is enabled over TCP without a password and no other clients are connected, attackers can...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (CNVD-2018-05088)

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A cross-site request forgery...

CVE-2018-0210

A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF...