GHSA-V988-828W-XVF2 Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui

Impact rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the webui within a close timeframe, thus allowing users to access the webui...

PT-2021-24462

Name of the Vulnerable Software and Affected Versions: rucio-webui versions 1.26.0 through 1.26.6 Description: The issue potentially leaks the contents of cookies to other sessions within a wsgi container, specifically affecting Rucio authentication tokens. This allows users to access the webui...

Plastic SCM 10.0.16.5622 Insecure Direct Object Reference

Exploit Title: Plastic SCM 10.0.16.5622 - WebAdmin Server Access Shodan Dork: title:"Plastic SCM" Date: 18.10.2021 Exploit Author: Basavaraj Banakar Vendor Homepage: https://www.plasticscm.com/ Software Link: https://www.plasticscm.com/download/releasenotes/10.0.16.5622 Version: Plastic SCM...

Plastic SCM 10.0.16.5622 - WebAdmin Server Access Vulnerability

Exploit Title: Plastic SCM 10.0.16.5622 - WebAdmin Server Access Shodan Dork: title:"Plastic SCM" Exploit Author: Basavaraj Banakar Vendor Homepage: https://www.plasticscm.com/ Software Link: https://www.plasticscm.com/download/releasenotes/10.0.16.5622 Version: Plastic SCM 10.0.16.5622 Tested on...

FortiSDNConnector - Credential leak

An insufficiently protected credentials vulnerability CWE-522 in FortiSDNConnector may allow an authenticated user to obtain third party device credentials via visiting the configuration page in the WebUI...

RaspAP Command Injection Vulnerability (CNVD-2021-94940)

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. a command injection vulnerability exists in includes/configureclient.php in RaspAP version 2.6.6. An attacker could...

RaspAP Remote Code Execution Vulnerability (CNVD-2021-94941)

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. raspap-webgui in RaspAP version 2.6.6 is vulnerable to remote code execution. The vulnerability stems from insecure...

CVE-2021-33032

A Remote Code Execution RCE vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request...

Remote code execution

A Remote Code Execution RCE vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request...

CVE-2021-33032

CVE-2021-33032 is an RCE in the WebUI of eQ-3 HomeMatic CCU2/CCU3 firmware (<= 2.57.5/

PT-2021-20024

Name of the Vulnerable Software and Affected Versions eQ-3 HomeMatic CCU2 firmware versions up to and including 2.57.5 eQ-3 HomeMatic CCU3 firmware versions up to and including 3.57.5 Description A Remote Code Execution issue in the WebUI component allows remote unauthenticated attackers to execu...

CVE-2021-33032: Improper Neutralization of Special Elements used in an OS Command

A Remote Code Execution RCE vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request...

CVE-2021-34821

CVE-2021-34821 affects AAT Novus Management System (NMS) up to version 1.51.2. The WebUI improperly handles 404s, allowing a remote, unauthenticated attacker to issue requests to non-existent URIs. The vulnerability stems from the URL path filename being copied into the HTML document as plain tex...

PT-2021-20670

Name of the Vulnerable Software and Affected Versions: AAT Novus Management System versions through 1.51.2 Description: A Cross Site Scripting XSS issue exists due to incorrect HTTP 404 error handling in the WebUI. This allows a remote, unauthenticated attacker to potentially exploit the issue by...

CVE-2021-34821: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL...

CVE-2021-21588

Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potentially exploit this vulnerability by tricking the user into performing unwanted actions on the Presentation Server and perform which may lead ...

Cross site scripting

Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potentially exploit this vulnerability by tricking the user into performing unwanted actions on the Presentation Server and perform which may lead ...

CVE-2021-21588

Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potentially exploit this vulnerability by tricking the user into performing unwanted actions on the Presentation Server and perform which may lead ...

PT-2021-14632

Name of the Vulnerable Software and Affected Versions Dell EMC PowerFlex versions 3.5.x Description The issue concerns a Cross-Site WebSocket Hijacking vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could exploit this by tricking a user into performing unwanted action...

CVE-2021-21588: Insufficient Verification of Data Authenticity

Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potentially exploit this vulnerability by tricking the user into performing unwanted actions on the Presentation Server and perform which may lead ...