Cross site scripting

A vulnerability has been identified in Teamcenter Active Workspace V5.2 All versions V5.2.9, Teamcenter Active Workspace V6.0 All versions V6.0.3. A reflected cross-site scripting XSS vulnerability exists in the web interface of the affected application that could allow an attacker to execute...

CVE-2022-32145

A vulnerability has been identified in Teamcenter Active Workspace V5.2 All versions V5.2.9, Teamcenter Active Workspace V6.0 All versions V6.0.3. A reflected cross-site scripting XSS vulnerability exists in the web interface of the affected application that could allow an attacker to execute...

CVE-2022-29034

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting XSS attacks...

The vulnerability in the web interface for managing device information on the Cisco Common Services Platform Collector allows a attacker to carry out cross-site scripting attacks.

The vulnerability in the web interface for collecting device information on the Cisco Common Services Platform Collector exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a...

Johnson Controls Metasys ADS/ADX/OAS Servers 跨站脚本漏洞

Johnson Controls Metasys ADS/ADX/OAS Servers is an application and data server from Johnson Controls, Inc. A cross-site scripting vulnerability exists in Johnson Controls Metasys ADS/ADX/OAS Servers versions 10 and 11, which arises from improper neutralization of input during web page generation...

PT-2022-19491 · Unknown +1 · Jupyter Notebook +3

Name of the Vulnerable Software and Affected Versions: Jupyter Server versions prior to 1.17.1 Jupyter Notebook versions 6.4.0 through 6.4.11 Jupyter Lab versions 6.4.0 through 6.4.11 Description: The issue allows an attacker to leak the access token assigned at start time by guessing or brute...

PT-2022-19373 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A vulnerability has been identified in the web interface of the affected application, where an error message pop-up window does not prevent the injection of JavaScript code. Thi...

The vulnerability in the web interface for managing device information on the Cisco Common Services Platform Collector allows a attacker to carry out cross-site scripting attacks.

The vulnerability in the web interface for collecting device information on the Cisco Common Services Platform Collector exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a...

The vulnerability in the web interface for managing device information on the Cisco Common Services Platform Collector allows a attacker to carry out cross-site scripting attacks.

The vulnerability in the web interface for collecting device information on the Cisco Common Services Platform Collector exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a...

Siemens Teamcenter Active Workspace

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Active Workspace Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for malicious code execution. 3...

CVE-2022-33174

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...

CVE-2022-33174

Summary: CVE-2022-33174 affects Powertek firmware-based Power Distribution Units prior to 3.30.30. An attacker can bypass active session authorization by sending an HTTP request to /cgi/get_param.cgi with the tmpToken cookie set to an empty string followed by a semicolon, enabling access to prote...

USN-5214-1: Cacti vulnerabilities

It was discovered that Cacti was incorrectly validating permissions for user accounts that had been recently disabled. An authenticated attacker could possibly use this to obtain unauthorized access to application and system data. CVE-2020-13230 It was discovered that Cacti was incorrectly...

CVE-2022-30075

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...

CVE-2022-30075

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...

Input validation

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...

CVE-2022-30075

CVE-2022-30075 affects TP-Link Archer AX50 router (firmware 210730 and older). The vulnerability enables remote code execution when a malicious backup/config file is imported via the web interface due to improper validation in the backup import handling. Exploitation has been demonstrated in publ...

TP-LINK AX50 代码注入漏洞

The TP-LINK AX50 is a router device from China P&L TP-LINK. The TP-LINK AX50 suffers from a code injection vulnerability that stems from the fact that importing a malicious backup file via the web interface may result in remote code execution due to improper authentication...

Poly Studio X30 / Studio X50 / Studio X70 / G7500 Command Injection Vulnerability

======================================================================= title: Authenticated Command Injection product: Poly Studio X30, Studio X50, Studio X70, G7500 vulnerable version: 3.4.0-292042, 3.5.0-344025, 3.6.0 fixed version: 3.7.0 or higher CVE number: CVE-2022-26481 impact: critical...

Poly EagleEye Director II 2.2.1.1 Command Injection / Authentication Bypass Vulnerability

======================================================================= title: Multiple Critical Vulnerabilities product: Poly EagleEye Director II vulnerable version: 2.2.1.1 Jul 1, 2021 fixed version: 2.2.2.1 or higher CVE number: CVE-2022-26479, CVE-2022-26482 impact: critical homepage:...