(0Day) CentOS Web Panel ajax_dashboard term SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the term parameter, the process does not proper...

CentOS Web Panel Directory Traversal (CVE-2018-18323)

A directory traversal vulnerability exists in centoswebpanel centos web panel. Successful exploitation of this vulnerability would allow a remote attacker to list directories on the affected system...

CVE-2020-7983

A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks...

CVE-2020-8829

CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25368)

Evenroute IQrouter is a smart router from Evenroute USA. A security vulnerability exists in the 'resetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the password of the root account...

Evenroute IQrouter Log Message Disclosure Vulnerability

Evenroute IQrouter is a smart router from Evenroute USA. A security vulnerability exists in the Web panel in Evenroute IQrouter 3.3.1 and earlier versions, which stems from incorrect access control. A remote attacker could exploit the vulnerability to read system logs...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25366)

Evenroute IQrouter is an intelligent router from Evenroute USA. A security vulnerability exists in the 'diagsetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the root account password...

Evenroute IQrouter Operating System Command Injection Vulnerability

Evenroute IQrouter is a smart router from Evenroute USA. A remote code execution vulnerability exists in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. An attacker can exploit this vulnerability to gain root privileges...

CVE-2020-11968

In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step for settin...

CVE-2020-11968

In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step for settin...

CVE-2020-11963

IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configurati...

CVE-2020-11966

In IQrouter through 3.3.1, the Lua function resetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

CVE-2020-11963

IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configurati...

CVE-2020-11964

In IQrouter through 3.3.1, the Lua function diagsetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

Remote code execution

IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configurati...

Design/Logic Flaw

In IQrouter through 3.3.1, the Lua function resetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

CVE-2020-11968

CVE-2020-11968 affects IQrouter web-panel up to version 3.3.1, where an incorrect access control allows remote readers to view system logs. The core issue is access control weakness in the web UI, not an execution bug by default. Public notes consistently mention this can occur on brand-new netwo...

CVE-2020-11968

In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step for settin...

CVE-2020-11966

In IQrouter through 3.3.1, the Lua function resetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

CVE-2020-11966

IQrouter vulnerable through version 3.3.1: the web-panel Lua function reset_password can be invoked remotely to arbitrarily change the root password. Affected: IQrouter firmware up to 3.3.1 (brand-new/unconfigured networks discussed in sources). Underlying issue: reset_password function exposes p...