The vulnerability in the web console of the Kaspersky Secure Mail Gateway security tool, which allows access to the root user rights.

The vulnerability of the Kaspersky Secure Mail Gateway web console relates to deficiencies in the process of eliminating special elements from the output data used by the incoming component. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain root user privilege...

DEBIAN-CVE-2016-6810

In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation...

Hawt.io admin terminal cross-site request forgery vulnerability

Hawt.io is a web console for managing Java frameworks. admin terminal is one of the management terminals. A cross-site request forgery vulnerability exists in the admin terminal in Hawt.io. A remote attacker could use this vulnerability to execute commands on the Karaf server...

Cambium Networks ePMP Cross-Site Scripting Vulnerability (CNVD-2018-01044)

Cambium Networks ePMP is a wireless network access platform from Cambium Networks. The platform provides video surveillance, Wi-Fi hotspots, and sensor connectivity.Web administration console is one of the administration console programs. A cross-site scripting vulnerability exists in the Device...

CVE-2017-5261

The CVE-2017-5261 entry concerns Cambium Networks cnPilot firmware with a file path traversal in the web administrative console’s ping and traceroute functions, affecting 4.3.2-R4 and earlier. Connected documents corroborate practical exploitability: a Metasploit module (Cambium cnPilot r200/r201...

Trend Micro OfficeScan Proxy Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro OfficeScan. Authentication is required to exploit this vulnerability. The specific flaw exists within the Web Console, which listens on TCP port 4343 by default. When parsing the tr...

BSA-2017-469

Security Advisory ID : BSA-2017-469 Component : JBOSS Application Revision : 1.0: Interim Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remo...

GHSA-67J6-XV27-W6WW Web Console (Ruby gem) contains whitelisted_ips bypass

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

Web Console (Ruby gem) contains whitelisted_ips bypass

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

Denial of service

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

CVE-2017-12251

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

CVE-2017-12251

The CVE-2017-12251 issue affects Cisco Cloud Services Platform (CSP) 2100 running software releases 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, or 2.2.2. The vulnerability arises from weaknesses in the generation of authentication mechanisms in the CSP web console URL, enabling an authenticated, remote at...

CVE-2017-12251

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

Cisco Cloud Services Platform Unauthorized Access Vulnerability

Cloud Services Platform 2100 is a unified and optimized x86 software and hardware platform for virtualizing data center network functions. The Cisco Cloud Services Platform CSP 2100 operates with a security vulnerability in the implementation of the Web console that could allow an authenticated,...

Cisco Cloud Services Platform 2100 Unauthorized Access Vulnerability

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

Apache ActiveMQ Web Console Default / No Credentials (HTTP)

The Apache ActiveMQ Web Console is unprotected or is using default credentials. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program...

Unrestricted file upload

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file...

Hawtio Cross-Site Request Forgery Vulnerability

Hawtio is a Web console for managing Java frameworks. A cross-site request forgery vulnerability exists in Hawtio. A remote attacker could exploit this vulnerability to perform unauthorized operations...

CVE-2017-10062

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Oracle Java Web Console. The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise...

Code injection

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Oracle Java Web Console. The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise...