CVE-2020-15935

CVE-2020-15935 affects FortiADC GUIs (versions 5.4.3 and earlier; 6.0.0 and earlier). The root cause is cleartext storage/deobfuscation of password fields in the GUI, enabling remote authenticated attackers to retrieve sensitive data such as LDAP passwords and RADIUS shared secret. The connected ...

CVE-2020-15935

A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields...

Multiple Products - Retrieval of sensitive information in cleartext via GUI

A cleartext storage of sensitive information in the GUI of FortiADC, FortiSIEM, FortiDDoS, FortiDDoS-CM and FortiDDoS-F may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords, RADIUS shared secret and the Elastic Cloud database password by...

CVE-2020-28968

Draytek VigorAP 1000C contains a stored cross-site scripting XSS vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field...

Cross site scripting

Draytek VigorAP 1000C contains a stored cross-site scripting XSS vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field...

CVE-2020-28968

The CVE-2020-28968 entry applies to Draytek VigorAP 1000C. A stored XSS vulnerability exists in the RADIUS Setting – RADIUS Server Configuration module, allowing an attacker to execute arbitrary web scripts or HTML via a crafted payload in the username input field. The documents do not specify af...

CVE-2020-28968

Draytek VigorAP 1000C contains a stored cross-site scripting XSS vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field...

Draytek VigorAP 1000C 跨站脚本漏洞

DrayTek Corporation Draytek VigorAp is a wireless access point from DrayTek Corporation. The Draytek VigorAP 1000C suffers from a cross-site scripting vulnerability that stems from the software's lack of effective filtering and validation of user uploaded parameters in the RADIUS Settings - RADIU...

CVE-2021-31378

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

CVE-2021-31378

CVE-2021-31378 affects Juniper Networks Junos OS in broadband subscriber management scenarios where RADIUS is used. An attacker can spoof messages from trusted RADIUS servers to a device after a subscriber logs in and requests logout, forcing the subscriber into a persistent “Terminating” state v...

CVE-2021-31378 Junos OS: An attacker sending spoofed RADIUS messages to a Junos OS device configured for broadband services may cause broadband subscribers to remain stuck in a "Terminating" state.

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

CVE-2021-31378

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

The vulnerability of the general proxy server RADIUS software Radsecproxy, related to insufficient input data validation, allows a perpetrator to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the general proxy server RADIUS software Radsecproxy is related to the lack of input validation in the scripts “naptr-eduroam.sh” and “radsec-dynsrv.sh”. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cau...

CVE-2021-36309

Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks...

Information disclosure

Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks...

CVE-2021-36309

Summary of CVE-2021-36309 : Dell Enterprise SONiC OS (Dell Enterprise SONiC OS) versions 3.3.0 and earlier are affected by an information-disclosure vulnerability. An authenticated attacker with system access can read sensitive information by abusing stored TACACS/RADIUS credentials. The impact i...

CVE-2021-36309

Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks...

Dell Enterprise Sonic Os 信息泄露漏洞

Dell Enterprise Sonic Os Dell Enterprise Sonic OS is an open source network operating system from Dell Dell. An information disclosure vulnerability exists in Dell Enterprise SONiC OS 3.3.0 and earlier versions, which can be exploited by an authenticated, malicious user to gain access to the syst...

MGASA-2021-0434 Updated proftpd packages fix security vulnerability

Fixes memory disclosure to RADIUS servers by modradius. Ftp clients like filezilla fail to detect locale with in log : "Status: Server does not support non-ASCII characters." This comes from proftpd MultilineRFC2228 directive enabled by default. Without this directive Filezilla is able to enable...

Updated proftpd packages fix security vulnerability

Fixes memory disclosure to RADIUS servers by modradius. Ftp clients like filezilla fail to detect locale with in log : "Status: Server does not support non-ASCII characters." This comes from proftpd MultilineRFC2228 directive enabled by default. Without this directive Filezilla is able to enable...