The vulnerability in the web interface for operating systems ArubaOS allows a hacker to execute arbitrary commands.

The vulnerability in the web interface for operating systems ArubaOS exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability in the web interface for operating systems ArubaOS exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. This allows attackers to execute arbitrary commands.

The vulnerability in the web interface for operating systems ArubaOS exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Lucee Authenticated Scheduled Job Code Execution Exploit

This Metasploit module can be used to execute a payload on Lucee servers that have an exposed administrative web interface. It's possible for an administrator to create a scheduled job that queries a remote ColdFusion file, which is then downloaded and executed when accessed. The payload is...

The vulnerability in the web interface of the Unified Remote software, a remote control program for computers, allows a hacker to execute arbitrary code.

The vulnerability of the Unified Remote web interface for remote control software management is related to an incorrect authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the FortiWAN traffic balancing system’s web interface allows a attacker to execute arbitrary commands.

The vulnerability of the FortiWAN traffic balancing system’s web interface is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability in the web interface of the Aruba EdgeConnect Enterprise network management platform allows a attacker to carry out XSS attacks.

The vulnerability in the web interface of the Aruba EdgeConnect Enterprise network management platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a specially created link...

The vulnerabilities in the web interface of FortiOS, the local software product FortiSwitch Manager, and the proxy server FortiProxy, designed for protecting against internet attacks, allow attackers to read and write files on a basic Linux system.

The vulnerability in the web interface of FortiOS operating systems, the local software management platform FortiSwitch Manager, and the proxy server for internet attack protection, FortiProxy, is related to errors in processing the relative path to the directory. Exploiting this vulnerability...

The vulnerability in the web interface for operating systems ArubaOS exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. This allows attackers to execute arbitrary commands.

The vulnerability in the web interface for operating systems ArubaOS exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 6800, 7800, and 8800 exists due to the possibility of inserting commands that allow a perpetrator to execute arbitrary code with root privileges.

The vulnerability of the web-based management interface for Microprogramming Software-based Cisco IP Phones 6800, Cisco IP Phone 7800, and Cisco IP Phone 8800 is related to the possibility of executing commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with...

CVE-2023-20079

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. For more information about these vulnerabilities, see the Details section of this advisor...

CVE-2023-20079

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. For more information about these vulnerabilities, see the Details section of this advisor...

Design/Logic Flaw

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. For more information about these vulnerabilities, see the Details section of this advisor...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This...

CVE-2023-1163 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversal

UNSUPPORTED WHEN ASSIGNED A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability is the function getSyslogFile of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option...

CVE-2023-20069 Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This...

PT-2023-9806 · Draytek · Draytek Vigor

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor versions 1.5.1.4 through 1.5.1.5 Description: The issue is related to the function sub 1225C in the mainfunction.cgi script of the DrayTek Vigor web interface, where inadequate data cleaning on the management level can be...

Critical Flaw in Cisco IP Phone Series Exposes Users to Command Injection Attack

Cisco on Wednesday rolled out security updates to address a critical flaw impacting its IP Phone 6800, 7800, 7900, and 8800 Series products. The vulnerability, tracked as CVE-2023-20078, is rated 9.8 out of 10 on the CVSS scoring system and is described as a command injection bug in the web-based...

The vulnerability in the web interface of Netgear N600 (WNDR3700)’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the web interface of Netgear N600 WNDR3700 microprogramming software routers is related to the lack of measures for cleaning input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Vulnerabilities fixed in Cisco IP Phones

Cisco has fixed two vulnerabilities in the web management interface of several IP phones. A malicious person with access to this web interface could exploit the vulnerabilities to cause a denial-of-service, or execute arbitrary code on the vulnerable phones. It is good practice not to have such a...

CVE-2023-20079

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. For more information about these vulnerabilities, see the Details section of this advisor...