CVE Vulnerability Catalog

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the NAME parameter in /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

A vulnerability in Progress Flowmon versions prior to 12.5.8 and 13.0.6 allows an attacker to trick an administrator into clicking a malicious link, potentially triggering unintended actions within their authenticated web session.

IBM Aspera Shares versions 1.9.9 through 1.11.0 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

IBM Aspera Shares versions 1.9.9 through 1.11.0 is vulnerable to HTTP header injection caused by improper validation of the HOST header. This could allow an attacker to conduct various attacks, including cross-site scripting, cache poisoning, or session hijacking.

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, thus altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

In IBM Aspera Shares versions 1.9.9 through 1.11.0, sessions are not invalidated after a password reset, which could allow an authenticated user to impersonate another user on the system.

IBM Aspera Shares versions 1.9.9 through 1.11.0 use weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information.

A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().

W Mbed TLS przed wersją 3.6.6 oraz 4.x przed wersją 4.1.0 oraz w TF-PSA-Crypto przed wersją 1.1.0 odkryto problem związany z przewidywalnym ziarnem w generatorze liczb pseudolosowych (PRNG).

Mbed TLS w wersjach od 3.3.0 do 3.6.5 oraz w wersji 4.0.0 umożliwia obniżenie poziomu algorytmu. Atakujący może wykorzystać tę podatność do wymuszenia użycia słabszych algorytmów kryptograficznych.

A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights allows an authenticated, remote attacker to write arbitrary files to the system. The issue is due to insufficient validation of the metadata update file.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This is due to improper validation of user-supplied input to the management interface. An attacker could exploit this by sending crafted HTTP requests to an affected device, leading to arbitrary code execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks and execute arbitrary commands as the root user. This is due to improper validation of user-supplied input. An attacker could exploit this by sending crafted commands to the management interface, leading to arbitrary command execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks and execute arbitrary commands as the root user. This is due to improper validation of user-supplied input. An attacker could exploit this by sending crafted commands to the management interface, leading to arbitrary command execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

Vulnerability in the web-based management interface of Cisco IMC allows an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. Due to insufficient input validation. Attacker can persuade a user to click a crafted link, leading to arbitrary script execution in the browser or access to sensitive information.

Vulnerability in the web-based management interface of Cisco IMC allows an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. Due to insufficient input validation. Attacker can persuade a user to click a crafted link, leading to arbitrary script execution in the browser or access to sensitive information.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing arbitrary script execution in the browser or access to sensitive browser-based information.

Vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, allowing arbitrary script code execution in the browser or access to sensitive browser-based information.