Cross site scripting

The CheckMK management web console versions 1.5.0 to 2.0.0 does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other client-side scripts, the XSS...

CVE-2021-36563

The CheckMK management web console versions 1.5.0 to 2.0.0 does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other client-side scripts, the XSS...

CVE-2021-36563

CVE-2021-36563 affects Checkmk Management Web Console (versions 1.5.0–2.0.0). The vulnerability is an input sanitization flaw in WATO module parameters that enables cross‑site scripting (XSS). Exploitation can occur via the web management interface with valid credentials or an hijacked session, p...

PT-2021-21290

Name of the Vulnerable Software and Affected Versions CheckMK management web console versions 1.5.0 through 2.0.0 Description The CheckMK management web console does not sanitise user input in various parameters of the WATO module, allowing an attacker to open a backdoor on the device with HTML...

CVE-2020-25206

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

CVE-2020-25206

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

Command injection

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

CVE-2020-25206

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

CVE-2020-25206

The web console for Mimosa B5, B5c, and C5x devices running firmware through 2.8.0.2 is vulnerable to authenticated command injection . The flaw exists in the Throughput, WANStats, PhyStats, and QosStats API classes , where an attacker with a web console account can execute operating system comma...

CVE-2020-25205

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the setbanner function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain...

CVE-2020-25205

The CVE-2020-25205 vulnerability affects Mimosa PTP/M5/M5c/C5x firmware up to version 2.8.0.2. It is a stored cross-site scripting flaw in the web console’s set_banner() function located at /var/www/core/controller/index.php. An unauthenticated attacker can write arbitrary JavaScript to /mnt/jffs...

PT-2021-11112 · Mimosa · Mimosa B5C +1

Name of the Vulnerable Software and Affected Versions: Mimosa B5, B5c, and C5x firmware versions through 2.8.0.2 Description: The web console for the affected firmware allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access t...

CVE-2020-25206: Improper Neutralization of Special Elements used in an OS Command

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

CVE-2021-3043

A reflected cross-site scripting XSS vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versio...

CVE-2021-3043 Prisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web Console

A reflected cross-site scripting XSS vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versio...

CVE-2021-3043: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versio...

PT-2021-18729

Name of the Vulnerable Software and Affected Versions Prisma Cloud Compute versions prior to 20.12.552 Prisma Cloud Compute versions prior to 21.04.439 Description A reflected cross-site scripting XSS issue exists in the Prisma Cloud Compute web console, allowing a remote attacker to execute...

CVE-2021-3043

A reflected cross-site scripting XSS vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versio...

Prisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web Console

A reflected cross-site scripting XSS vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versio...

PT-2021-6007

Name of the Vulnerable Software and Affected Versions SolarWinds Patch Manager affected versions not specified Description The issue is related to the deserialization of untrusted data in the Web Console Chart Endpoint, which can lead to remote code execution. An unauthorized attacker with networ...