The vulnerability in the web interface of Netgear DG834Gv5 integrated software for routers allows a hacker to disclose protected information.

The vulnerability in the web-based management interface of Netgear DG834Gv5 integrated software lies in the unencrypted storage of critical information. Exploiting this vulnerability allows an attacker to disclose the protected data remotely...

The vulnerability of the web interface of the monitoring and analysis software for network traffic in industrial networks, SINEC Traffic Analyzer, allows a hacker to perform a CSRF attack.

The vulnerability of the web interface of the monitoring and network traffic analysis software in industrial networks, SINEC Traffic Analyzer, is related to the falsification of cross-site requests. Exploiting this vulnerability allows a perpetrator to carry out a CSRF attack using a specially...

The vulnerability in the web interface of microprogramming software for devices for remote control of lighting and energy consumption from Schneider Electric Sage allows a perpetrator to compromise the integrity of protected information and cause service interruptions.

The vulnerability of the web interface of microprogramming software for devices for remote control of lighting and energy consumption in Schneider Electric Sage is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a...

Vulnerability of the web interface for operating system management software FortiOS and the proxy server FortiProxy, which allows for the execution of arbitrary code.

The vulnerability in the web management interface of FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute...

CVE-2024-5951

Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this...

CVE-2024-20405

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are...

PT-2024-36031 · Iap-420 · Iap-420

Name of the Vulnerable Software and Affected Versions: IAP-420 versions 2.01e and below Description: The issue is related to missing input validation in the ORing IAP-420 web-interface, which allows stored Cross-Site Scripting XSS. This problem is being actively exploited. Recommendations: For...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to execute arbitrary code.

The vulnerability of the web interface for managing Cisco Firepower Management Center FMC software involves a lack of measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code by injecting a specially crafted SQL query remotely...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 6800, 7800, 8800, and Cisco Video Phone 8875 allows a perpetrator to disclose protected information.

The vulnerability of the web-based management interface for Cisco IP Phones 6800, 7800, 8800, and Cisco Video Phone 8875 is related to the ability to bypass authentication due to a software bug. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

LoLLMs Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. LoLLMs suffers from a command injection vulnerability that stems from insufficient cleanup of user input, leading to arbitrary code execution...

Digital Prototype Systems NetGuardian DIN 安全漏洞

Digital Prototype Systems NetGuardian DIN is a small industrial RTU from Digital Prototype Systems. A security vulnerability exists in the Digital Prototype Systems NetGuardian DIN that stems from multiple vulnerabilities in the web interface...

The vulnerability of the setWiFiExtenderConfig function in TOTOLINK EX200 router microprogramming software allows a attacker to perform XSS attacks.

The vulnerability of the setWiFiExtenderConfig function in TOTOLINK EX200 router microprogramming software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the web interface of Tp-Link AC1350 wireless access points allows a hacker to trigger a service failure.

The vulnerability of the web interface of Tp-Link AC1350 wireless access points is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially crafted HTTP POST request...

DirectCyber Evolution Controller 安全漏洞

DirectCyber Evolution Controller is an access control controller software from DirectCyber, Inc. that is used to controller physical access to facilities. A security vulnerability exists in DirectCyber Evolution Controller version 2.04.560.31.03.2024 and prior versions, which stems from an...

LoLLMs 路径遍历漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A path traversal vulnerability exists in LoLLMs lollms-webui that stems from insufficient validation of user-supplied file paths...

The vulnerability in the web interface for controlling the Flowmon operating system of network monitoring devices allows a perpetrator to execute arbitrary commands.

The vulnerability of the web interface for controlling the Flowmon operating system in devices for network monitoring exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute...

PT-2024-3823 · Cisco · Cisco Unified Communications Manager Im & Presence Service

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P versions not specified Description: The issue is related to a path traversal flaw in the web-based interface of the system, which could allow a remote attacker to...

PT-2024-3799 · Cisco · Cisco Emergency Responder

Name of the Vulnerable Software and Affected Versions: Cisco Emergency Responder affected versions not specified Description: A vulnerability in the web UI of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack. This is due to insufficie...

CVE-2023-47162

IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 270973...

CVE-2024-26294

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to comple...