CVE-2024-20536 Cisco Nexus Dashboard Fabric Controller SQL Injection Vulnerability

A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller NDFC could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL commands on an affected device. This vulnerability is due to insufficient...

CVE-2024-20536

Cisco Nexus Dashboard Fabric Controller (NDFC) SQL Injection vulnerability affects REST API endpoint and web-based management interface. Root cause: insufficient validation of user input enables authenticated, read-only attackers to cause arbitrary SQL commands, potentially reading, modifying, or...

CVE-2024-20534

CVE-2024-20534 affects Cisco Desk Phone 9800 Series, Cisco IP Phone 6800/7800/8800 Series, and Cisco Video Phone 8875 with Multiplatform Firmware. The issue is stored cross-site scripting (XSS) in the device web UI caused by improper validation of user-supplied input. An authenticated, remote att...

CVE-2024-20530 Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An...

CVE-2024-20530

Cisco ISE contains a web-based management interface XSS vulnerability (CVE-2024-20530). The issue arises from improper input validation in the interface, enabling an unauthenticated, remote attacker to lure a user via a crafted link to execute arbitrary script code in the user’s browser or access...

CVE-2024-20525 Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An...

CVE-2024-20511 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...

CVE-2024-20511

CVE-2024-20511 describes a cross-site scripting (XSS) vulnerability in the web-based management interfaces of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The issue stems from insufficient input validation in the web UI, allowing an...

CVE-2024-20504

CVE-2024-20504 is a stored XSS vulnerability in the web-based management interface of Cisco AsyncOS Software used by Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance. The issue stems from insufficient input validation, allowing an authenticated, remote attacker t...

CVE-2024-20487 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an...

CVE-2024-20487 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an...

CVE-2024-20487

Cisco ISE (Cisco Identity Services Engine) is affected by CVE-2024-20487, a stored XSS vulnerability in the web-based management interface. An authenticated, low-privilege attacker can inject malicious code into specific pages to execute script in the user’s browser or access browser-based inform...

Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists...

CVE-2024-50333 RCE in ModuleBuilder in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...

CVE-2024-9579

A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself...

CVE-2024-9579 Certain Poly Video Conference Devices – Potential Remote Code Execution

A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself...

CVE-2024-9579 Certain Poly Video Conference Devices – Potential Remote Code Execution

A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself...

CVE-2024-9579

CVE-2024-9579 concerns Poly video conferencing devices. The issue is a firmware input sanitation flaw that enables remote code execution only via a layered attack; it cannot be exploited in isolation. Affected are Poly video conferencing devices (firmwareSanitization issue). Exploitation requires...

GHSA-6P55-QR3J-MPGQ AgentScope uses `eval`

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

SuiteCRM 输入验证错误漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from an input validation error vulnerability that stems from user input being written directly to the file system without validation...