9680 matches found
CVE-2020-3222
Cisco IOS XE Software Web UI contains an unauthenticated proxy service at a specific UI endpoint. The vulnerability allows an adjacent, unauthenticated attacker to bypass access controls by proxying requests through the management network, with the proxy reachable via the management VRF. Remediat...
Cisco IOx Application Framework Local Manager Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based Local Manager interface of the Cisco IOx Application Framework could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based Local Manager interface of an affected device. The attacker must have...
PT-2020-2680
Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web-based user interface of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass access control restrictions on an affected...
PT-2020-2681
Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to a vulnerability in the web-based user interface of Cisco IOS XE Software, which could allow an authenticated, remote attacker with administrative...
CVE-2020-3339: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this...
PT-2020-2673
Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to insufficient input validation of specific HTTP requests in the web-based user interface of Cisco IOS XE Software. This could allow an authenticated, remo...
Oracle Hyperion Financial Reporting Web Based Report Designer Unauthorized Access
The vulnerability of the Web Based Report Designer component of the Oracle Hyperion Financial Reporting application for automating budget management processes is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protect...
PT-2020-6874 · Flexnet +1 · Lmadmin +1
Name of the Vulnerable Software and Affected Versions: FlexNet Publisher's lmadmin version 11.16.5 Description: A Denial of Service DoS issue was found in FlexNet Publisher's lmadmin, related to resource release errors. This can be exploited by a remote attacker to cause a service disruption,...
Windows 10 / Windows Server 2016 September 2017 Information Disclosure Vulnerability (CVE-2017-8529)
The remote Windows host is missing a security update or a registry setting required to enable protections for CVE-2017-8529. It is, therefore, affected by an information disclosure vulnerability: - An information disclosure vulnerability exists when affected Microsoft scripting engines do not...
Stored Cross-Site Scripting Vulnerability in TomExam
TomExam is a web-based exam system that runs in both public and LAN environments, creates question banks and organizes exams. A stored cross-site scripting vulnerability exists in TomExam. An attacker can exploit the vulnerability to obtain an administrator cookie...
Plesk/myLittleAdmin - ViewState .NET Deserialization Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule VIEWSTATEGENERATOR = 'CA0B0334'.freeze VIEWSTATEVALIDATIONKEY = "\x5c\x7e\xef\x66\x50\x63\x9d\x2c\xb8\xfa\xa0\xda\x36\xaf\x24\x45\x2d\xcf" ...
CVE-2020-3184
A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates...
CVE-2020-3184 Cisco Prime Collaboration Provisioning Software SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates...
CVE-2020-3184 Cisco Prime Collaboration Provisioning Software SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates...
Cisco Adaptive Security Appliance Software CSRF (cisco-sa-20190501-asa-csrf)
According to its self-reported version, Cisco Adaptive Security Appliance ASA Software is affected by a cross-site request forgery CSRF attack in the web-based management interface due to insufficient CSRF protections. An unauthenticated, remote attacker can exploit this, by persuading a user of...
CVE-2020-3184: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates...
PT-2020-3053
Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning Software affected versions not specified Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected...
CVE-2020-1056
An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain. In a web-based attack scenario, an attacker could host a website that is used ...
Privilege escalation
An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used t...