CVE-2024-23169

The CVE-2024-23169 vulnerability affects RSA NetWitness Platform (NetWitness) 11.7.2.0, where the web interface allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation. The available connected documents confirm the affected product and the specific U...

Cisco Modeling Labs 安全漏洞

Cisco Modeling Labs is a software application from Cisco, Inc. A local network simulation tool that runs on workstations and servers. A security vulnerability exists in Cisco Modeling Labs that stems from the improper handling of certain messages returned by the associated external authentication...

The vulnerability of the web-based interface for controlling microprogrammed software in the Eltex MES5324 switch lies in insufficient validation of input data. This allows a perpetrator to trigger a reboot of the switch.

The vulnerability of the web interface for controlling microprogrammed software in the Eltex MES5324 switch lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to trigger a restart of the switch by sending specially crafted HTTP...

CVE-2024-5917

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

CVE-2024-5917

CVE-2024-5917 describes a server-side request forgery in Palo Alto Networks PAN-OS. An authenticated administrator can use the web interface as a proxy to access internal network resources that should be inaccessible. The issue affects PAN-OS versions before certain fixed releases; remediation ad...

CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to carry out a cross-site scripting attack.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files.

The vulnerability of the Cisco Identity Services Engine ISE’s web management interface relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to upload arbitrary files using a specially created HTTP request...

The vulnerability in the web interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) allows a attacker to execute XSS attacks.

The vulnerability in the web interface for Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition exists due to the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to carry...

The vulnerability of Siemens SINEMA Remote Connect lies in the insufficient checking of unusual or exceptional states, allowing a perpetrator to trigger a service failure.

The vulnerability of the Siemens SINEMA Remote Connect web interface is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 9800, 7800, 8800, and 8875 allows a perpetrator to access confidential information.

The vulnerability of the web interface of Microprogramming Software for Cisco IP Phones 9800, 7800, 8800, and 8875 lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information from a remote location...

The vulnerability of the LuCI web interface in the embedded operating system OpenWrt allows a hacker to elevate their privileges to the root level.

The vulnerability of the LuCI web interface in the embedded operating system OpenWrt is related to insufficient protection of registration data. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the root level using the JSON-RPC API...

PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible. Work around: Recommended mitigation—The vast majority of firewalls already...

The vulnerability of the FileManager web interface, related to deserialization mechanism flaws, allows an attacker to execute arbitrary code.

The vulnerability of the FileManager web interface is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Palo Alto Expedition 1.2.91 Remote Code Execution

class MetasploitModule 'Palo Alto Expedition Remote Code Execution CVE-2024-5910 and CVE-2024-9464', 'Description' = %q Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below. The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the...

PT-2024-8522 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS versions prior to 7.4.4 FortiProxy versions prior to 7.4.4 FortiSASE version 24.2.b and earlier Description: The issue is related to an improper neutralization of special elements in output used by a downstream component, which may...

PT-2024-8719 · Siemens · Sinec Ins

Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 3 Description: A vulnerability has been identified in the affected application, which does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated...

Cisco Identity Services Engine Web Interface Cross-Site Scripting Vulnerability

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be use...

Vulnerability of Cisco IOS and IOS XE operating system web interfaces, allowing attackers to perform CSRF attacks

The vulnerability of Cisco IOS and IOS XE web interfaces is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack by sending a specially crafted HTTP GET request remotely...

The vulnerability in the web interface of Cisco Unified Industrial Wireless network devices’ Cisco Ultra-Reliable Wireless Backhaul software allows a attacker to execute arbitrary code with root privileges.

The vulnerability of the Cisco Unified Industrial Wireless network device management web interface for Cisco Ultra-Reliable Wireless Backhaul URWB is related to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a...