CVE-2022-24391

CVE-2022-24391 affects Fidelis Network and Deception CommandPost. The web interface is vulnerable to SQL injection when accessed by a user with basic (user) privileges, potentially enabling malicious input to alter queries. Affected versions are Fidelis Network and Deception prior to 9.4.5. Patch...

CVE-2022-24391 Authenticated SQL Injection Vulnerability in Fidelis Network and Deception

Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability...

CVE-2022-24392

CVE-2022-24392 affects Fidelis Network and Deception CommandPost. The vulnerability allows authenticated command injection via the web interface when using feed_comm_test for the feed parameter; a crafted HTTP request could execute system commands on CommandPost and return results over HTTP withi...

CVE-2022-24392 Authenticated Command Injection Vulnerability in Fidelis Network and Deception

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feedcommtest” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and...

CVE-2022-24393 Authenticated Command Injection Vulnerability in Fidelis Network and Deception

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “checkverticaupgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost...

CVE-2022-24393

The vulnerability CVE-2022-24393 affects Fidelis Network and Deception CommandPost. It allows authenticated command injection via the web interface by abusing the check_vertica_upgrade value for the cpIp parameter. An attacker with an authenticated session could craft an HTTP request to execute s...

CVE-2022-24394 Authenticated Command Injection Vulnerability in Fidelis Network and Deception

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “updatecheckfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost...

CVE-2022-24394

Summary of CVE-2022-24394 (Fidelis Network/Deception CommandPost) : A command-injection vulnerability exists in Fidelis Network Deception CommandPost via the update_checkfile value of the filename parameter. The issue permits an authenticated attacker to craft an HTTP request that executes system...

Katello uses hard coded credential

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secrettoken value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary...

GHSA-5XV2-Q475-RWRH Katello uses hard coded credential

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secrettoken value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary...

Katello uses hard coded credential

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secrettoken value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary...

The vulnerability in the web interface of the Cisco Unified Communications Manager IM & Presence Service allows a perpetrator to execute arbitrary SQL queries.

The vulnerability of the Web interface for managing the Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...

The vulnerability of the HTTP interface implementation for Zyxell network interfaces allows attackers to execute arbitrary commands.

The vulnerability of the HTTP interface implementation for Zyxell network interfaces relates to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by introducing a specially crafted file...

The vulnerability in the web interface of the Cisco Unified Communications Manager (CM), Cisco Unified Communications Manager Session Management Edition (SME), and the integrated messaging system Cisco Unity Connection allows a perpetrator to perform cross-site scripting attacks.

The vulnerability of the Web interface for managing Cisco Unified Communications Manager CM, Cisco Unified Communications Manager Session Management Edition SME, and the integrated messaging system Cisco Unity Connection is related to the lack of security measures taken to protect the web page...

Fidelis Network Deception SQL注入漏洞

Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A SQL injection vulnerability exists in Fidelis...

CVE-2022-24391

Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability...

Aruba ClearPass Policy Manager 操作系统命令注入漏洞

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. A remote command injection vulnerability exists in the web management interface of Aruba ClearPass Policy Manager versions 6.10.4 and earlier, 6.9.9 and earlier, a...

Aruba ClearPass Policy Manager 操作系统命令注入漏洞

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. A remote command injection vulnerability exists in the web management interface of Aruba ClearPass Policy Manager versions 6.10.4 and earlier, 6.9.9 and earlier, a...

Cobbler Path Traversal vulnerability

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile...

GHSA-XC7W-JVHX-P6Q9 Cobbler Path Traversal vulnerability

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile...