The vulnerability in the web interface of the Cisco Unified Communications Manager IM & Presence Service allows a perpetrator to execute arbitrary SQL queries.

The vulnerability of the Web interface for managing the Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...

Katello uses hard coded credential

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secrettoken value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary...

CVE-2022-24391: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability...

Fidelis Network Deception SQL注入漏洞

Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A SQL injection vulnerability exists in Fidelis...

The vulnerability in the web interface of the Cisco Unified Communications Manager (CM), Cisco Unified Communications Manager Session Management Edition (SME), and the integrated messaging system Cisco Unity Connection allows a perpetrator to perform cross-site scripting attacks.

The vulnerability of the Web interface for managing Cisco Unified Communications Manager CM, Cisco Unified Communications Manager Session Management Edition SME, and the integrated messaging system Cisco Unity Connection is related to the lack of security measures taken to protect the web page...

The vulnerability of the HTTP interface implementation for Zyxell network interfaces allows attackers to execute arbitrary commands.

The vulnerability of the HTTP interface implementation for Zyxell network interfaces relates to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by introducing a specially crafted file...

CVE-2022-24391

Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability...

Aruba ClearPass Policy Manager 操作系统命令注入漏洞

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. A remote command injection vulnerability exists in the web management interface of Aruba ClearPass Policy Manager versions 6.10.4 and earlier, 6.9.9 and earlier, a...

Aruba ClearPass Policy Manager 操作系统命令注入漏洞

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. A remote command injection vulnerability exists in the web management interface of Aruba ClearPass Policy Manager versions 6.10.4 and earlier, 6.9.9 and earlier, a...

Cobbler Path Traversal vulnerability

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile...

GHSA-XC7W-JVHX-P6Q9 Cobbler Path Traversal vulnerability

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile...

VulnCheck KEV: CVE-2022-30525

A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device...

The vulnerability in the web interface for managing Cisco Unified Communications Manager (CM) and Cisco Unified Communications Manager Session Management Edition (SME) systems allows a perpetrator to disclose protected information.

The vulnerability of the Cisco Unified Communications Manager CM and Cisco Unified Communications Manager Session Management Edition SME web interfaces is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow a malicious actor to disclose...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability in the web interface for managing Cisco Firepower Management Center FMC software involves the failure to remove script-related HTML tags from the web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to execute cross-site scripting (XSS) attacks.

The vulnerability in the web interface for managing Cisco Firepower Management Center FMC software involves a lack of measures to protect input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to execute cross-site scripting (XSS) attacks.

The vulnerability in the web interface for managing Cisco Firepower Management Center FMC software involves a lack of measures to protect input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...

The vulnerability in the web interface for controlling Cisco Unified Communications Manager (CM) and Cisco Unified Communications Manager Session Management Edition (SME) systems allows a attacker to perform a CSRF attack.

The vulnerability of the Cisco Unified Communications Manager CM and Cisco Unified Communications Manager Session Management Edition SME web interfaces is related to insufficient verification of the HTTP request source. Exploiting this vulnerability could allow a malicious actor to execute a CSRF...

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV340, RV340W, RV345, and R345P allows a hacker to execute arbitrary code.

The vulnerability of the web-based management interface for Cisco Small Business RV340, RV340W, RV345, and R345P microprogramming software involves reading data outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2020-22984

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key parameter to the getGoogleExtraConfig task...

CVE-2022-25172

An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the sessi...