CVE-2017-6503: Improper Neutralization of Input During Web Page Generation

WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS...

CVE-2017-6504: Improper Input Validation

WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...

CVE-2016-8494

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

Authorization

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

CVE-2016-8494

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

CVE-2016-8494

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

CVE-2016-8494

Fortinet Connect is affected. The issue stems from insufficient verification of uploaded files in the web UI, allowing a webui administrator to upload a new theme that enables arbitrary code execution on the system. The connected Fortinet advisory FG-IR-16-080 confirms the root access potential v...

Fortinet Connect admin able to gain root access

A webui administrator may create a new theme that performs arbitrary code execution on the system...

PT-2017-9664

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue is related to insufficient verification of uploaded files, which allows attackers with webui administrator privileges to execute arbitrary code by uploading a new webui them...

CVE-2016-8494: Undefined Security Weakness

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme...

FortiOS Local Admin Password Hash Leak Vulnerability

A read-only administrator may have access to read-write administrators password hashes not including super-admins stored on the appliance via the webui REST API , and may therefore be able to crack them...

LifeSize Room 5.0.9 - Multiple Vulnerabilities

LifeSize Room 5.0.9 - Multiple Vulnerabilities Source: https://github.com/XiphosResearch/exploits/tree/master/deathsize LifeSize Room 5.0.9, remote config disclosure, code execution & local privilege escalation Ultimately the Lifesize Room products have fundamentally flawed firmware, many similar...

LifeSize Room 5.0.9 - Multiple Vulnerabilities

Source: https://github.com/XiphosResearch/exploits/tree/master/deathsize LifeSize Room 5.0.9, remote config disclosure, code execution & local privilege escalation Ultimately the Lifesize Room products have fundamentally flawed firmware, many similar very bugs in the WebUI exist and thier support...

CVE-2015-7360

FortiSandbox WebUI prior to version 2.1 is vulnerable to multiple cross-site scripting (XSS) flaws. The Flaws allow remote attackers to inject arbitrary script or HTML via: (1) the serial parameter in alerts/summary/profile/; (2) the urlForCreatingReport parameter in csearch/report/export/; (3) t...

PT-2016-3748

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 2.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Web User Interface WebUI of FortiSandbox. These vulnerabilities allow remote attackers to inject arbitrary web script or...

CVE-2015-7360: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Web User Interface WebUI in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 serial parameter to alerts/summary/profile/; the 2 urlForCreatingReport parameter to csearch/report/export/...

Skydive - An Open Source Real-Time Network Topology and Protocols Analyzer

Skydive is an open source real-time network topology and protocols analyzer. It aims to provide a comprehensive way of understanding what is happening in the network infrastructure. Skydive agents collect topology informations and flows and forward them to a central agent for further analysis. Al...

Open Source Real Time Network Analyzer: skydive

Open Source Real Time Network Topology and Protocols Analyzer Skydive is an open source real-time network topology and protocols analyzer. It aims to provide a comprehensive way of understanding what is happening in the network infrastructure. Skydive agents collect topology informations and flow...

CVE-2016-3978

The Web User Interface WebUI in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting XSS attacks via the "redirect" parameter to "login."...

CVE-2016-3978

The Web User Interface WebUI in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting XSS attacks via the "redirect" parameter to "login."...