Buffer overflow

Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS...

CVE-2022-37892

CVE-2022-37892 concerns Aruba’s InstantOS/ArubaOS web management interface. The vulnerability is a stored cross-site scripting (XSS) flaw that could let an unauthenticated remote attacker execute arbitrary script code in a victim’s browser within the affected interface. Affected versions include ...

CVE-2022-37890

CVE-2022-37890 describes unauthenticated buffer overflow vulnerabilities in Aruba InstantOS and ArubaOS 10 web management interfaces. Exploitation can execute arbitrary commands on the underlying Aruba InstantOS/OS, with affected versions including InstantOS 6.4.x (6.4.4.8-4.2.4.20 and below), 6....

PT-2022-6050 · Aruba · Aruba Instant +1

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS versions 6.4.4.8 through 6.4.4.20 and below Aruba InstantOS versions 6.5.4.23 and below Aruba InstantOS versions 8.6.0.18 and below Aruba InstantOS versions 8.7.1.9 and below Aruba InstantOS versions 8.10.0.1 and below ArubaOS...

CVE-2022-37891

Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS...

CVE-2022-37892

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a...

CVE-2022-37896

CVE-2022-37896 describes a reflected XSS vulnerability in Aruba InstantOS/ArubaOS 10 web management interfaces. A remote attacker could exploit input handling in the affected web UI to trigger script execution in a victim’s browser within the Aruba InstantOS/ArubaOS context. Affected versions inc...

CVE-2022-37896

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser ...

Cisco BroadWorks 跨站脚本漏洞

Cisco BroadWorks is a carrier-grade unified communications software platform from Cisco. It is used to deploy cloud calls from public network platforms on any type of wired or wireless network architecture. A cross-site scripting vulnerability exists in Cisco BroadWorks Hosted Thin Receptionist,...

Aruba Networks ArubaOS and InstantOS Buffer Overflow Vulnerability

ArubaOS is the network operating system for Aruba Mobility Controllers, Mobility Masters, and controller-managed Access Points APs.InstantOS is an Arch Linux-based distribution. Aruba Networks ArubaOS and InstantOS are vulnerable to a buffer overflow vulnerability that originates from a boundary...

Aruba Networks ArubaOS 安全漏洞

ArubaOS is the network operating system for Aruba Mobility Controllers, Mobility Masters, and controller-managed Access Points APs.InstantOS is an Arch Linux-based distribution. Aruba Networks ArubaOS and InstantOS are vulnerable to a buffer overflow vulnerability that originates from a boundary...

PT-2022-6398 · Aruba · Aruba Instant +1

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS versions 6.4.4.8 through 6.4.4.20 and below Aruba InstantOS versions 6.5.4.23 and below Aruba InstantOS versions 8.6.0.18 and below Aruba InstantOS versions 8.7.1.9 and below Aruba InstantOS versions 8.10.0.1 and below ArubaOS...

CVE-2022-40628

The CVE-2022-40628 affects Tacitine Firewall EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100, versions 19.1.1–22.20.1. Root cause: improper control of code generation in the web-based management interface, enabling an unauthenticated remote attacker to send a crafted HTTP request and execute arbit...

Tacitine EN6200 代码注入漏洞

Tacitine Firewall EN6200 is a series of firewalls from Tacitine. The Tacitine Firewall EN6200 suffers from a command injection vulnerability that stems from improper control of code generation in the web-based management interface of the Tacitine-Firewall. An unauthenticated, remote attacker coul...

PT-2022-16207 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.6 and below Aruba ClearPass Policy Manager versions 6.9.11 and below Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remo...

Zyxel GS1900 安全特征问题特征问题漏洞

The Zyxel GS1900 is a managed switch from Taiwan, China-based Hopkins Zyxel. A security signature issue vulnerability exists in the Zyxel GS1900 series prior to version V2.70, which stems from incorrectly generating RSA keys using a low entropy random source. An attacker exploits this vulnerabili...

UCMS 跨站脚本漏洞

UCMS is a content management system written in PHP. A security vulnerability exists in UCMS v1.6.0, which originates from the fact that an attacker can implement cross-site scripting via the Import function of its web management interface...

Milesight Video Management Systems 输入验证错误漏洞

Milesight Video Management Systems is a video management software from the Chinese company Milesight. A security vulnerability in Milesight Video Management Systems VMS versions prior to 40.7.0.79-r1, which stems from improper handling of input in the web-based management interface, can be...

NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability

Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server...

CVE-2022-23690

A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact version AOS-CX running on the switch. This allows an attacker to retrieve information which could be used to more precisely target the switch for further...