Event-ID-193-Rule-Name-SOC231-Cisco-IOS-XE-Web-UI-ZeroDay-CVE-2023-20198-

此存储库没有 README。...

CVE-2021-21972

Uso:CVE-2021-21972.py option -u or --url: URL objetivo -t or --type: Tipo de payload ssh/webshell -f or --file: Archivo a cargar webshell o authorizedkeys Ejemplo: CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p or --proxy: Configurar proxy Ejemplo: CVE-2021-21972.py -u...

VMware NSX SD-WAN Edge - Command Injection

VMware NSX SD-WAN Edge formerly VeloCloud Edge before 3.1.2 contains an unauthenticated command injection in the local web UI diagnostic tools Ping/Traceroute. This template detects it reliably by injecting 'id', 'whoami', and a random marker. id: CVE-2018-6961 info: name: VMware NSX SD-WAN Edge ...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

DEBIAN-CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

EUVD-2026-75108

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

Linux Distros Unpatched Vulnerability : CVE-2026-18147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password...

Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

...

GHSA-CV22-G7MW-8V73 vulnerabilities

Vulnerabilities for packages: nemo, open-webui...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. In versions 0.3.0 through before 0.5.0 , the POST /ui/hosts Web UI endpoint hardcodes a 24-hour enrollment token expiry instead of using the configured enrollment_token_ttl (server-wide or per-network) resolver that the API pat...

CVE-2026-55513 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...

CVE-2026-55513 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...

OPENSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media

These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-53683

FreeIPA Web UI is affected by a client-side open redirect in reset_password.html. The file parses the url query string parameter and assigns it directly to window.location after the password-reset workflow completes, without validation or allowlisting. This allows an attacker to redirect users to...

CVE-2026-82694

A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be...

CVE-2026-82693

A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been...