CVE-2020-10657

Summary (CVE-2020-10657): Proofpoint Insider Threat Management Server (formerly ObserveIT Server) prior to version 7.9.1 contains a vulnerability in the ITM web console’s ImportAlertRules feature. The issue is caused by improper deserialization, allowing an authenticated remote attacker with admi...

Security Bulletin: IBM MQ Appliance is affected by a cross-site scripting vulnerability (CVE-2020-7676)

Summary IBM MQ Appliance has addressed a cross-site scripting vulnerability. Vulnerability Details CVEID: CVE-2020-7676 DESCRIPTION: angular.js is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject...

Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated)

Exploit Title: Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit Authenticated Date: 12-29-2020 Exploit Author: Jeremy Brown Vendor Homepage: https://support.zoom.us/hc/en-us/articles/201363093-Deploying-the-Meeting-Connector Software Link:...

activemq: remote XSS in web console diagram plugin

A flaw was found in activemq. A specifically crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info...

Trend Micro OfficeScan Improper Access Control Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro OfficeScan. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue...

Trend Micro OfficeScan Improper Access Control Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro OfficeScan. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue...

Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue resul...

Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue resul...

Unauthorized Access Vulnerability in RG-NBR700G Router from Riptide Networks

RG-NBR700G is an Internet Behavior Management IBM router from Ruijie, which is designed for office scenarios. Unauthorized access vulnerability exists in RG-NBR700G, which can be exploited by an attacker to access the main page address of a web console or a connection that is not allowed to be...

The vulnerability in the Intel Raid Web Console 3, which exists due to insufficient validation of input data, allows a hacker to trigger a service failure.

The vulnerability of Intel Raid Web Console 3 exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2020-13658

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

CVE-2020-13658

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

Cross site request forgery (csrf)

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

Lansweeper Cross-Site Request Forgery Vulnerability

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A cross-site request forgery vulnerability exists in Lansweeper version 8.0.130.17. The vulnerability stems from the vulnerability of the web...

CVE-2020-13658

CVE-2020-13658 affects Lansweeper 8.0.130.17 where the web console is vulnerable to a CSRF attack that enables a low-privilege user to elevate privileges within the application. The vulnerability arises from insufficient CSRF protection in the web interface, leading to unauthorized privilege esca...

CVE-2020-25045

Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system...

CVE-2020-25045

CVE-2020-25045 affects Kaspersky Security Center and Kaspersky Security Center Web Console installers; the issue is DLL hijacking that enables local privilege escalation. Affected versions are before 12 and before 12 Patch A. Red Hat and NCSC advisories reference fixes in Kaspersky Security Cente...

CVE-2020-24572

An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured and virtually unrestricted web console to attack the underlying OS Raspberry Pi running this software, and execute commands on the system including ones for uploading o...

Code injection

An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured and virtually unrestricted web console to attack the underlying OS Raspberry Pi running this software, and execute commands on the system including ones for uploading o...

CVE-2020-24572

An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured and virtually unrestricted web console to attack the underlying OS Raspberry Pi running this software, and execute commands on the system including ones for uploading o...