CVE-2015-7291

Cross-site request forgery CSRF vulnerability in advpwdcgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-7290

Cross-site scripting XSS vulnerability in advpwdcgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter...

CVE-2009-5149

Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue...

Belkin N600 DB Wireless Dual Band N+ Management Interface No Password Setting Vulnerability

Belkin N600 DB Wireless Dual Band N+ is a wireless dual band router product from Belkin USA. The Belkin N600 DB Wireless Dual Band N+ fails to set a default password for the web management interface, allowing an attacker to gain access to the web management interface or perform cross-site request...

Cisco TelePresence IX5000 Systems Certificate Information Disclosure Vulnerability

A vulnerability in the directory on the Web Management Interface of Cisco TelePresence IX5000 Systems could allow an unauthenticated, remote attacker to decrypt captured traffic on the affected device or perform a man-in-the-middle attack. The vulnerability is due to the inclusion of the...

Mediabridge Medialink Wireless-N Broadband Router MWN-WAPR300N contains multiple vulnerabilities

Overview Mediabridge Medialink Wireless-N Broadband Router MWN-WAPR300N, firmware version 5.07.50 and possibly earlier, uses non-unique default credentials and is vulnerable to universal authentication bypass and cross-site request forgery CSRF. Description CWE-255: Credentials Management -...

Cisco TelePresence Video Communication Server Expressway Password Change Vulnerability

The Cisco TelePresence Video Communication Server VCS Expressway is a telepresence video communication server. The Password Change feature in the Web management interface of the Cisco TelePresence VCS Expressway fails to properly perform authentication operations, allowing remote attackers to...

TOTOLINK Router Models Backdoor Vulnerability

TOTOLINK manufactures routers, wireless access points and networking equipment. A backdoor vulnerability exists in TOTOLINK Router Models. An attacker can bypass the authentication system by using a hidden /boafrm/formSysCmd form and use a remote code execution in the HTTP remote management...

EMC Isilon OneFS Command Injection Vulnerability

The EMC Isilon OneFS Operating System is an intelligent file system that combines a file system, volume manager and data protection. The EMC Isilon OneFS web management interface fails to properly filter input when invoked to perform log collection, which could allow a malicious user to execute...

Cisco Hosted Collaboration Solution Arbitrary Command Execution Vulnerability

Cisco Hosted Collaboration Solution HCS is a suite of hosted collaboration solutions. The solution includes Cisco TelePresence, Customer Collaboration and Unified Communications products to support customers using collaboration technologies in public, private and hybrid cloud models. A security...

Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability

The Cisco Headend Digital Broadband Delivery System is a front-end broadband digital delivery system. A cross-site scripting vulnerability exists in the Cisco Headend Digital Broadband Delivery System. Because the program's WEB management interface fails to correctly filter user-submitted input, ...

Citrix NetScaler Default Credentials (HTTP)

The remote Citrix NetScaler system is using known default credentials for the HTTP login. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cisco Unity Connection CUCReports Web Interface Cross-Site Request Forgery Vulnerability

Cisco Unified Communications Manager is a call processing component of a Unified Communications system. A cross-site request forgery vulnerability exists in the web management interface of Cisco Unified Communications Manager, which allows remote attackers to construct malicious URIs, trick users...

Sagem F@st 3304-V2 - Local File Inclusion

Title : Sagem F@st 3304-V2 Directory Traversal Vulnerability Vendor : http://www.sagemcom.com Severity : High Tested Router : Sagem F@st 3304-V2 3304, other versions may also be affected Date : 2015-03-01 Author : Loudiyi Mohamed Contact : [email protected] Blog :...

CrushFTP 7.2.0 - Multiple Vulnerabilities

CrushFTP 7.2.0 - Multiple Vulnerabilities ======================================================== I. Overview ======================================================== Multiple CSRF & Cross-Site Scripting XSS vulnerabilities have been identified in Crushftp 7.2.0 Web Interface on default...

Fortinet FortiWeb Stored XSS Vulnerability (FG-IR-14-001)

Fortinet FortiWeb is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2011-5283

Cross-site scripting XSS vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to hijack the authentication of administrators for requests that perform a reboot via a request to...

Cross site scripting

Cross-site scripting XSS vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action...

CVE-2011-5284

CVE-2011-5284 describes a Cross-site Request Forgery vulnerability in Smoothwall Express 3.1 and 3.0 SP3 and earlier, specifically in the web management interface’s httpd/cgi-bin/shutdown.cgi. The vulnerability allows an attacker to hijack an administrator’s authenticated session to perform reboo...