CVE-2024-5917

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-5917

CVE-2024-5917 describes a server-side request forgery in Palo Alto Networks PAN-OS. An authenticated administrator can use the web interface as a proxy to access internal network resources that should be inaccessible. The issue affects PAN-OS versions before certain fixed releases; remediation ad...

CVE-2024-5917: Server-Side Request Forgery (SSRF)

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

Cisco IP Phones Information Disclosure

The vulnerability of the web interface of Microprogramming Software for Cisco IP Phones 9800, 7800, 8800, and 8875 lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information from a remote location...

Cisco Identity Services Engine Upload Arbitrary Files

The vulnerability of the Cisco Identity Services Engine ISE’s web management interface relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to upload arbitrary files using a specially created HTTP request...

Cisco Identity Services Engine XSS

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks...

Siemens SINEMA Remote Connect DoS

The vulnerability of the Siemens SINEMA Remote Connect web interface is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cisco Unified Communications Manager XSS

The vulnerability in the web interface for Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition exists due to the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to carry...

LuCI Web Interface Privilege Escalation

The vulnerability of the LuCI web interface in the embedded operating system OpenWrt is related to insufficient protection of registration data. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the root level using the JSON-RPC API...

PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible. Work around: Recommended mitigation—The vast majority of firewalls already...

Palo Alto Expedition 1.2.91 Remote Code Execution

class MetasploitModule 'Palo Alto Expedition Remote Code Execution CVE-2024-5910 and CVE-2024-9464', 'Description' = %q Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below. The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the...

FileManager Web Interface Code Execution

The vulnerability of the FileManager web interface is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2024-8522 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS versions prior to 7.4.4 FortiProxy versions prior to 7.4.4 FortiSASE version 24.2.b and earlier Description: The issue is related to an improper neutralization of special elements in output used by a downstream component, which may...

PT-2024-8719 · Siemens · Sinec Ins

Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 3 Description: A vulnerability has been identified in the affected application, which does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated...

Cisco Identity Services Engine Web Interface Cross-Site Scripting Vulnerability

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be use...

Cisco Ultra-Reliable Wireless Backhaul Software Code Execution Root Privileges

The vulnerability of the Cisco Unified Industrial Wireless network device management web interface for Cisco Ultra-Reliable Wireless Backhaul URWB is related to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a...

Cisco IOS CSRF

The vulnerability of Cisco IOS and IOS XE web interfaces is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack by sending a specially crafted HTTP GET request remotely...

CVE-2019-20457

An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be retrieved without authentication, because the response header of any failed login attempt returns an incomplete authorization cookie. The value of the authorization cookie is the MD...

CVE-2020-11918

An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on all users, including passwords, can be found in cleartext in the backup file. An attacker capable of accessing the web interface can create the backup file...