CVE Vulnerability Catalog

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the group parameter in /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior have a stored XSS vulnerability via the user parameter in /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the mimetypes parameter in /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /cgi-bin/incoming.cgi. An authenticated attacker can inject JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the dscp parameter in /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the name parameter in /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark user ham spam parameter in /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /manage/dhcp/fixed_leases/. An authenticated attacker can inject JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the NAME parameter in /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

A vulnerability in Progress Flowmon versions prior to 12.5.8 and 13.0.6 allows an attacker to trick an administrator into clicking a malicious link, potentially triggering unintended actions within their authenticated web session.

A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().

W Mbed TLS przed wersją 3.6.6 oraz 4.x przed wersją 4.1.0 oraz w TF-PSA-Crypto przed wersją 1.1.0 odkryto problem związany z przewidywalnym ziarnem w generatorze liczb pseudolosowych (PRNG).