Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. More Information:...

CVE-2017-3845

CVE-2017-3845 concerns a cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance. Affected: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 (11.5(0) affected); earlier than 11.0 not vulnerable. Root cause: in...

CVE-2017-3845

A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Affected Products: Cisco Prime...

CVE-2017-3828

Cisco Unified Communications Manager (CUCM) Switches Web UI is vulnerable to cross-site scripting (XSS) via unauthenticated remote access. The issue arises from insufficient validation of user-supplied input in the web-based management interface, enabling an attacker to execute script in a user's...

Centrally Manage SSH Administrative Access: KeyBox

Centrally Manage SSH Administrative Access KeyBox is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user’s public SSH keys. Key management and administration is based on profiles assigned to...

Cisco UCS Director Privilege Escalation Vulnerability

A vulnerability in the web-based GUI of Cisco UCS Director could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrig...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (cisco-sa-20170215-cucm1)

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Copyright C 2017 Greenbon...

HP Smart Storage Administrator command injection

Added: 02/16/2017 CVE: CVE-2016-8523 BID: 95868 Background HP Smart Storage Administrator HP SSA is a web-based application that helps an administrator configure, manage, diagnose, and monitor HP ProLiant Smart Array Controllers and other storage devices such as host bus adapters HBAs and HP...

HP Smart Storage Administrator command injection

Added: 02/16/2017 CVE: CVE-2016-8523 BID: 95868 Background HP Smart Storage Administrator HP SSA is a web-based application that helps an administrator configure, manage, diagnose, and monitor HP ProLiant Smart Array Controllers and other storage devices such as host bus adapters HBAs and HP...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (cisco-sa-20170215-cucm2)

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. Copyright C 2017 Greenbon...

Privilege escalation

A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control RBAC...

CVE-2017-3801

Cisco UCS Director privilege escalation (CVE-2017-3801) affects the web-based GUI in Cisco UCS Director 6.0.0.0 and 6.0.0.1. The root cause is improper RBAC after enabling the Developer Menu, enabling an authenticated, local user with an end-user profile to add catalogs containing arbitrary workf...

Cisco Secure Access Control System XML External Entity Vulnerability

A vulnerability in the web-based user interface of the Cisco Secure Access Control System ACS could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity XXE wh...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due ...

Cisco Intrusion Prevention System Device Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of the Cisco Intrusion Prevention System Device Manager IDM could allow an unauthenticated, remote attacker to view sensitive information stored in certain HTML comments. The vulnerability is due to improper masking of sensitive data in...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due ...

IT ITems DataBase Cross-Site Scripting Vulnerability

ITITems DataBase ITDB is a set of Web-based asset inventory management tools. A security vulnerability exists in ITITDB 1.23 and earlier versions, which originates when the "value" HTTP POST parameter is passed to the "itdb-1.23/js/DataTables-1.8.2/examples/examplessupport/editableajax.php" URL...

Multiple SQL Injection Vulnerabilities in Ecava IntegraXor

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. Ecava IntegraXor suffers from multiple SQL injection vulnerabilities that stem from a failure to properly validate a SQL query before using user input. An attacker could use this vulnerability ...

Moderate: Red Hat Security Advisory: tfm-rubygem-fusor_ui security update

An update for tfm-rubygem-fusorui is now available for Red Hat QCI 1.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Honeywell XL Web II Controller Clear Text Stored Password Vulnerability

Honeywell XL Web Controller is a web-based SCADA system. A plaintext stored password vulnerability exists in the Honeywell XL Web II Controller, which could allow an attacker to obtain a user's password by accessing a specific URL...