CAGE Web Design | Rolf Van Gelder Security Vulnerabilities

CVE-2009-1227

NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) Authorization or (2) Referer HTTP header to TCP port...

CVE-2023-4392

A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component Cookie Handler. The manipulation leads to cleartext storage of sensitive information. The attack may be launched remotely. The complexity...

Outlook Web Access URL Injection

Due to a lack of sanitization of the user input, the remote version of Microsoft Outlook Web Access 2003 is vulnerable to URL injection which can be exploited to redirect a user to a different, unauthorized web server after authenticating to...

YusASP Web Asset Manager Vulnerability

YusASP Web Asset Manager is a complete file manager for your website. If left uprotected, the YusASP allows you to anage the remote...

Cherokee Web Server Detection (HTTP)

HTTP based detection of the Cherokee Web...

OpenSIS 7.3 - SQL Injection

OpenSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of...

Web Server info.php / phpinfo.php Detection

Many PHP installation tutorials instruct the user to create a PHP file that calls the PHP function 'phpinfo()' for debugging purposes. Various PHP applications may also include such a file. By accessing such a file, a remote attacker can discover a large amount of information about the remote web.....

CVE-2024-25597

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through...

CVE-2024-31084

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pulsar Web Design Weekly Class Schedule allows Reflected XSS.This issue affects Weekly Class Schedule: from n/a through...

Cisco IOS XE Software Web UI Command Injection Vulnerability (cisco-sa-web-cmdinj4-S2TmH7GA)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more...

CKAN Web Detection

The web UI for CKAN, an open source data management system was detected on the remote...

OpenMediaVault Web Detection

The web management interface for OpenMediaVault was detected on the remote...

Apache Tomcat Servers - Remote Code Execution

Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to.....

CVE-2022-41063

Microsoft Excel Remote Code Execution...

CVE-2022-41106

Microsoft Excel Remote Code Execution...

Web Application Scanner

This plugin provides vulnerability detections in Web applications and Web site...

trixbox Web Detection

The web interface for trixbox, an IP-PBX application based on Asterisk, was detected on the remote...

OpenGear Web Detection

The web management interface for an OpenGear series 7x00 appliance was detected on the remote host. It is possible to extract the firmware version and model information if login credentials are...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in spring-web-5.3.15.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of spring-web-5.3.15.jar Vulnerability Details ** CVEID: CVE-2024-22243 DESCRIPTION: **VMware Tanzu Spring Framework could allow a remote attacker to conduct phishing attacks, caused by an open redirect...

teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload

Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. Versions prior to v0.1.1 are vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute...

teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload

Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. Versions prior to v0.1.1 are vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute...

Zyxel NAS Device Web UI Detection

The remote web server hosts a Zyxel web application which indicates it is a Zyxel...

'//WEB-INF/' Information Disclosure Vulnerability (HTTP)

Various application or web servers / products are prone to an information disclosure...

Cassini / CassiniEx Web Server Detection (HTTP)

HTTP based detection of the Cassini / CassiniEx Web...

CVE-2021-43256

Microsoft Excel Remote Code Execution...

CVE-2021-40474

Microsoft Excel Remote Code Execution...

CVE-2023-34237

SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the...

CVE-2021-31939

Microsoft Excel Remote Code Execution...

Moxa NPort Unprotected Web Console

The remote Moxa NPort Web Console is not protected by a ...

Apache ActiveMQ Web Console Default Credentials

ActiveMQ Web Console, an administrative interface for Apache ActiveMQ, is protected using default credentials. Note that no authentication mechanism was provided prior to version 5.4.0. However, in version 5.4.0, HTTP Basic Authentication was an option, and starting with version 5.8.0, this was...

Zabbix Web Interface Default Administrator Credentials

The remote Zabbix Web Interface uses a default set of credentials ('Admin' / 'zabbix') to control access to its management interface. With this information, an attacker can gain administrative access to the...

CVE-2021-40472

Microsoft Excel Information Disclosure...

FatPipe MPVPN Web Detection

The web UI for FatPipe MPVPN was detected on the remote...

Harbor Web Interface Detection

The web interface for Harbor was detected on the remote...

Commvault Web Console Detection

The web console for Commvault was detected on the remote...

AVTech Web Interface Detection

Nessus was able to detect the web interface for an AVTech device on the remote...

NAS4Free Web UI Detection

The remote web server is the user interface for NAS4Free, an open-source network-attached storage software distribution based on FreeBSD. NAS4Free is a direct continuation of the original FreeNAS...

Web Application Firewall Detection

By analyzing error codes and messages returned from some web queries, Nessus is able to determine that the remote web server is protected by a web application firewall. Such protection may disrupt scan results. Countermeasures have been taken to make the scan as reliable as...

Reflected XSS in Metrics Web Page

Reflected XSS in Sidekiq Web UI via the /metrics HTTP end-point and the substr query param:...

Checkbox Survey Web Detection

Checkbox Survey, a web application for creating surveys was detected on the remote host. Note: If credentials for HTTP basic authentication / digest are supplied, then an attempt to retrieve the version information from the API will be...

Rancher Web Interface Detection

Rancher, a Kubernetes management platform, was detected based on the web...

AXIS Web Interface Detection

Nessus was able to detect the web interface for an AXIS device on the remote...

Grafana Labs Web Detection

The web UI for Grafana Labs was detected on the remote host. Note : The application can be reconfigured to reveal the version by setting hide_version = false under [auth.anonymous] in the grafana.ini...

GitLab Web UI Detection

GitLab web user interface detected on remote host. GitLab is a web-based DevOps lifecycle tool that provides a Git repository manager providing wiki, issue-tracking and continuous integration and deployment pipeline features, using an open-source license, developed by GitLab...

Apple AirPlay Web Detection

Apple AirPlay, formerly AirTunes, was detected on the remote host. It is possible to obtain information about the remote device from this service's...

Kubernetes Web API Detection

The web API for Kubernetes was detected on the remote...

NetApp OnTAP Web Detection

The web interface for NetApp OnTAP was detected on the remote...

NETGEAR Web Interface Detection

Nessus was able to detect the web administration interface for a NETGEAR device on the remote...

Graylog2 Web Interface Detection

The web interface for Graylog2, a log collection and analysis platform, was detected on the remote host. It is possible to extract version information if login credentials are provided on...

Oracle Web Determinations Detection

The remote web server hosts Oracle Web Determinations, a web-based interactive assessment system that is a component of Oracle Policy...