PAN-OS: DOM-Based cross site scripting vulnerability in management web interface

A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's...

PT-2020-15243

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 7.1.26 PAN-OS versions prior to 8.1.13 PAN-OS versions prior to 9.0.6 PAN-OS 8.0 all versions Description A DOM-Based Cross Site Scripting issue exists in PAN-OS and Panorama Management Web Interfaces. A remote attacke...

Siemens SCALANCE X Unauthorized Access

The vulnerability of Siemens SCALANCE X industrial switchboard web interfaces lies in the absence of authentication for critical functions. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Cisco IOS Cross-site Forgery

The vulnerability in Cisco IOS XE and Cisco IOS web interfaces is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform cross-site forgery of requests remotely...

D-Link DIR-868L B1 Wireless Router Unauthorized Access

The vulnerability of the web interfaces of D-Link DIR-868L B1 and D-Link DIR-817LW A1 wireless routers is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using value...

A Web-Driven World Needs Better Web Security

Web interfaces are everywhere. From social media sites to online shopping portals to your CRM, the humble web interface is now used to access much of the online world. So, it isn’t difficult to see why web applications are a prime target for cybercriminals. Because they’re used by customers and...

CVE-2019-17512

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

Authentication flaw

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to logclear.php, which could be used to erase attack traces...

CVE-2019-17511

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via logget.php, which could be used to discover the intranet network structure...

Authentication flaw

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via logget.php, which could be used to discover the intranet network structure...

CVE-2019-17511

CVE-2019-17511 affects D-Link DIR-412 A1-1.14WW routers. The issue is exposed web pages that operate without authentication (notably log_get.php), enabling an attacker to retrieve the router’s log file and potentially map the intranet network structure. The root cause is lack of authentication on...

CVE-2019-17506

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password and other information via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZEDGROUP=1%0a to getcfg.php...

CVE-2019-17506

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password and other information via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZEDGROUP=1%0a to getcfg.php...

CVE-2019-17505

CVE-2019-17505 affects the D-Link DAP-1320 A2-V1.21 wireless range extender. The vulnerability arises from web interfaces that do not require authentication, enabling remote retrieval of the Wi‑Fi SSID and password (via uplink_info.xml). Impact is information disclosure of credentials, with CVSS ...

Frenemy at the Gates: The Breaching

Online businesses have to be careful. It’s a dangerous world, full of anonymous people and services wearing digital skins. It sounds horrific because it is. On the other side of a transaction, could be anyone. Extra measures have to be made to secure web interfaces and API endpoints that online...

Frenemy at the Gates: The Breaching

Online businesses have to be careful. It’s a dangerous world, full of anonymous people and services wearing digital skins. It sounds horrific because it is. On the other side of a transaction, could be anyone. Extra measures have to be made to secure web interfaces and API endpoints that online...

Cisco Wireless LAN Controllers Data Compromise

The vulnerability of the mechanism for identifying web interfaces of microprogrammed software controllers for Cisco Wireless LAN Controllers WLC is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information by...

Cisco Expressway Gateway 11.5.1 Directory Traversal

Advisory: Directory Traversal in Cisco Expressway Gateway RedTeam Pentesting discovered a directory traversal vulnerability in Cisco Expressway which enables access to administrative web interfaces. Details ======= Product: Cisco Expressway Gateway Affected Versions: 11.5.1, possibly others Fixed...

Cisco Small Business RV320 RV325 XSS

The vulnerability of the web interfaces of Cisco Small Business RV320 and Cisco Small Business RV325 routers exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Authentication flaw

D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW A1-1.04, DIR-816L B1-2.06, DIR-81...