CVE-2023-5372

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21AAZF.15C0 and NAS542 firmware versions through V5.21ABAG.12C0 could allow an authenticated attacker with administrator privileges to execute some operating system OS commands by sending a crafte...

Command injection

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21AAZF.15C0 and NAS542 firmware versions through V5.21ABAG.12C0 could allow an authenticated attacker with administrator privileges to execute some operating system OS commands by sending a crafte...

CVE-2023-5372

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21AAZF.15C0 and NAS542 firmware versions through V5.21ABAG.12C0 could allow an authenticated attacker with administrator privileges to execute some operating system OS commands by sending a crafte...

CVE-2023-5372

The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21AAZF.15C0 and NAS542 firmware versions through V5.21ABAG.12C0 could allow an authenticated attacker with administrator privileges to execute some operating system OS commands by sending a crafte...

PT-2024-1409 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 versions through V5.21AAZF.15C0 Zyxel NAS542 versions through V5.21ABAG.12C0 Description: The issue is related to a post-authentication command injection vulnerability. It could allow an authenticated attacker with administrator...

CVE-2024-20272

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a...

CVE-2024-20270

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This...

CVE-2023-20271

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of...

CVE-2023-20257

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker cou...

CVE-2024-0533

A vulnerability was found in Tenda A15 15.13.07.13. It has been rated as critical. This issue affects some unknown processing of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument devName leads to stack-based buffer overflow. The...

PT-2024-1457 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda A15 version 15.13.07.13 Description: A critical issue affects the function set repeat5 of the file /goform/WifiExtraSet in the Web-based Management Interface component. The manipulation of the argument wpapsk crypto2 4g or wpapsk crypto...

Cisco BroadWorks Application Security Vulnerability

Cisco BroadWorks Application is an enterprise-class calling and collaboration platform from Cisco. A security vulnerability exists in the Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform, which stems from a vulnerability in the web-based management...

PT-2023-25650 · Prolion · Prolion Cryptospike

Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: A hard-coded cryptographic private key used to sign JWT authentication tokens allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via...

CVE-2023-6265

UNSUPPORTED WHEN ASSIGNED Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported...

Directory traversal

UNSUPPORTED WHEN ASSIGNED Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported...

CVE-2023-6265

DrayTek Vigor2960 (versions 1.5.1.4–1.5.1.5) is affected by a directory traversal vulnerability in the mainfunction.cgi dumpSyslog option parameter. An authenticated attacker with access to the web management interface can delete arbitrary files on the device. The vulnerability affects only these...

CVE-2023-6265 DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal

UNSUPPORTED WHEN ASSIGNED Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported...

PT-2023-32582 · Draytek · Draytek Vigor2960

Name of the Vulnerable Software and Affected Versions: Draytek Vigor2960 versions 1.5.1.4 through 1.5.1.5 Description: The issue allows an authenticated attacker with access to the web management interface to delete arbitrary files via directory traversal. This is achieved through the...

Cisco IP Phone 安全漏洞

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. Cisco IP Phones suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the web-based management...

Cisco Identity Services Engine 安全漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. The Cisco Identity Services Engine suffers from...