CVE-2019-20458

CVE-2019-20458 affects Epson Expression Home XP255 (version 20.08.FM10I8). The root cause is that the device ships with no password and does not prompt the user to set one, enabling anyone who can reach the web admin panel to gain admin privileges. Public sources corroborate that this results in ...

CVE-2019-20458

An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes and functions without a password. The user is at no point prompted to set up a password on the device leaving a number of devices without a password. In this case, anyone connecting to the we...

RHSA-2023:1486 Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update

Bulletin has no description...

RHSA-2022:1628 Red Hat Security Advisory: web-admin-build security update

Bulletin has no description...

RHSA-2020:5599 Red Hat Security Advisory: web-admin-build security and bug fix update

Bulletin has no description...

Security Bulletin: Security Vulnerabilities discovered in IBM Security Verify Directory (CVE-2022-32753, CVE-2022-32756, CVE-2022-32754)

Summary Security Vulnerabilities discovered in Web Admin Tool provided by IBM Security Verify Directory products have been resolved. Vulnerability Details CVEID:CVE-2022-32753 DESCRIPTION: IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an...

Cisco Unified Communications Manager 安全漏洞

Cisco Unified Communications Manager is a call processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists in Cisco Unified...

SFTPGo Security Vulnerabilities

SFTPGo is a full-featured and highly configurable SFTP server by Nicola Murino, a personal developer in Italy. A security vulnerability exists in SFTPGo versions v2.2.0 through v2.6.1, which stems from the SFTPGo WebAdmin and WebClient support for password reset, which, if enabled, allows even...

PHOENIX CONTACT CHARX SEC-3000 安全漏洞

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in the PHOENIX CONTACT CHARX SEC-3000 version 1.5.1 and earlier, which originates from an unauthenticated, remote attacker who can extract session tokens via a MitM attack...

Openmediavault Remote Code Execution / Local Privilege Escalation Exploit

Openmediavault versions prior to 7.0.32 have a vulnerability that occurs when users in the web-admin group enter commands on the crontab by selecting the root shell. As a result of exploiting the vulnerability, authenticated web-admin users can run commands with root privileges and receive revers...

CVE-2024-22188

TYPO3 before 13.0.1 allows an authenticated admin user with system maintainer privileges to execute arbitrary shell commands with the privileges of the web server via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELT...

CVE-2023-4951

CVE-2023-4951 describes a cross-site scripting (XSS) vulnerability in GreenRADIUS, affecting the web admin interface’s pagination on the Client-based Authentication Policy Configuration screen. Affected software is GreenRADIUS v5.1.1.1 and earlier. The root cause is an XSS flaw in the pagination ...

CVE-2023-4951 Cross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" Screen

A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2...

CVE-2023-4951 Cross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" Screen

A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2...

Linksys WRT54GL 命令注入漏洞

Linksys WRT54GL is a wireless router from Linksys USA. A security vulnerability exists in Linksys WRT54GL version 4.30.18.006. By exploiting this vulnerability to gain web administrative privileges, an attacker can inject commands into the post request parameters wlant, wlrate, wlattenctl, ttcpnu...

The vulnerability in the web administration interface of the Local Status Page (LSP) of Cisco Meraki software for network devices allows a hacker to trigger a service failure or gain unauthorized access to protected information.

The vulnerability of the administration web interface for Local Status Pages LSP in Cisco Meraki network devices stems from the low entropy of default account credentials. Exploiting this vulnerability could allow an attacker to cause service interruptions or gain unauthorized access to protected...

Important: Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update

An update is now available for Red Hat Gluster Storage 3.5 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

SUSE CVE-2008-0564

Multiple cross-site scripting XSS vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 editing templates and 2 the list's "info attribute" in the web administrator interface, a different vulnerability than...

CVE-2022-36222

Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface...

Hardcoded credentials

Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface...