PT-2023-30077 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web Description: A stack overflow issue was discovered via the function formSysLog. Recommendations: For TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web, consider disabling the formSysLog...

The vulnerability of the web interface of the microprogramming software router Connectize G6 AC2100 allows a hacker to perform a CSRF attack.

The vulnerability of the web interface of the microprogramming router Connectize G6 AC2100 is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a remote attacker to execute a CSRF attack...

Cross-site Scripting (XSS)

nagvis is vulnerable to Cross-site Scripting XSS. An attacker could exploit this vulnerability by tricking a user into clicking on a malicious link or visiting a malicious website. The malicious link or website would contain a specially crafted XSS payload, which would be injected into the NagVis...

GHSA-9QQG-MH7C-CHFQ Apache Airflow vulnerable to Exposure of Sensitive Information

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow. This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for...

CVE-2023-46319

WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface...

Information disclosure

WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface...

IBM Sterling Partner Engagement Manager 跨站脚本漏洞

IBM Sterling Partner Engagement Manager PEM is a supply chain partner management solution that brings improved efficiency and accuracy, enhanced visibility and transparency, and more to organizations and their supply chain partners. A cross-site scripting vulnerability exists in IBM Sterling...

The vulnerability in the web interface of the Cisco IOS XE operating system allows a perpetrator to execute arbitrary commands on a device with root privileges.

The vulnerability of the Cisco IOS XE operating system’s web interface is related to errors in privilege management. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on a device with root privileges remotely...

The vulnerability of Weintek’s cMT3000 HMI Web CGI panel’s microprogramming software arises from buffer overflow in the stack. This allows a malicious actor to execute arbitrary code.

The vulnerability of Weintek’s cMT3000 HMI Web CGI panel software lies in buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of Weintek’s cMT3000 HMI Web CGI panel’s microprogramming software arises from buffer overflow in the stack. This allows a malicious actor to bypass the authentication process.

The vulnerability of Weintek’s cMT3000 HMI Web CGI panel software lies in buffer overflow attacks within the stack. Exploiting this vulnerability could allow an attacker to bypass the authentication process...

The vulnerability of the Web UI component of the Oracle Enterprise Communications Broker session manager and the Oracle Enterprise Session Border Controller application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web UI component of the Oracle Enterprise Communications Broker session manager and the Oracle Enterprise Session Border Controller application is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to...

The vulnerability of the application interface for WebDAV cloud software for creating and using Nextcloud data storage allows a perpetrator to gain access to confidential information.

The vulnerability of the WebDAV application programming interface of cloud-based software for creating and using Nextcloud data storage solutions is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to gain access to...

CVE-2023-40145

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device...

CVE-2023-38584

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin commandwb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication...

CVE-2023-45992

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certa...

CVE-2023-45992

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certa...

Cross site request forgery (csrf)

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certa...

CVE-2023-45992

RUCKUS Cloudpath web interface (version 5.12 build 5538 or earlier) is affected by a remote, unauthenticated XSS and CSRF vulnerability. The issue allows an attacker to execute persistent XSS/CSRF via crafted input in the onboarding portal’s macaddress parameter and, with a specific admin action,...

PT-2023-6359 · Connectize · Connectize Ac21000 G6

Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: A Cross Site Request Forgery CSRF vulnerability exists, allowing attackers to gain control of the device via a crafted GET request to /man password.htm. This issue is related to the we...

CVE-2023-4896

A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices...