| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-7991 | Cri | 0.64 | 9.8 | 0.02 | Apr 22, 2017 | Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php. | ||
| CVE-2016-9954 | Hig | 0.49 | 7.5 | 0.02 | Apr 21, 2017 | The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression with a repeating pattern. | ||
| CVE-2016-5399 | Hig | 0.47 | 7.8 | 0.10 | Apr 21, 2017 | The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive. | ||
| CVE-2016-5168 | Hig | 0.49 | 7.5 | 0.02 | Apr 21, 2017 | Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information. | ||
| CVE-2016-3702 | Med | 0.35 | 5.3 | 0.01 | Apr 21, 2017 | Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information. | ||
| CVE-2016-3109 | Cri | 0.59 | 9.8 | 0.28 | Apr 21, 2017 | The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. | ||
| CVE-2016-3067 | Cri | 0.57 | 9.8 | 0.02 | Apr 21, 2017 | Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges. | ||
| CVE-2016-2433 | Hig | 0.57 | 8.8 | 0.01 | Apr 21, 2017 | The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary code in the context of the kernel. | ||
| CVE-2016-2347 | Hig | 0.44 | 7.8 | 0.03 | Apr 21, 2017 | Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive. | ||
| CVE-2016-2173 | Cri | 0.64 | 9.8 | 0.06 | Apr 21, 2017 | org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code. | ||
| CVE-2016-1561 | Hig | 0.58 | 7.5 | 0.74 | Apr 21, 2017 | ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image. | ||
| CVE-2016-1560 | Cri | 0.72 | 9.8 | 0.72 | Apr 21, 2017 | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session. | ||
| CVE-2016-1520 | Hig | 0.51 | 7.8 | 0.02 | Apr 21, 2017 | The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application. | ||
| CVE-2016-1519 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate. | ||
| CVE-2016-1518 | Hig | 0.53 | 8.1 | 0.02 | Apr 21, 2017 | The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs,… | ||
| CVE-2016-1221 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | ||
| CVE-2016-1210 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | ||
| CVE-2016-1198 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | Photopt for Android before 2.0.1 does not verify SSL certificates. | ||
| CVE-2016-1187 | Med | 0.44 | 6.8 | 0.01 | Apr 21, 2017 | Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates. | ||
| CVE-2016-1186 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates. | ||
| CVE-2017-8051 | Cri | 0.68 | 9.8 | 0.16 | Apr 21, 2017 | Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands. | ||
| CVE-2017-8050 | Hig | 0.49 | 7.5 | 0.01 | Apr 21, 2017 | Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password. | ||
| CVE-2017-7994 | Med | 0.42 | 6.5 | 0.03 | Apr 21, 2017 | The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. | ||
| CVE-2016-6519 | Med | 0.28 | 5.4 | 0.01 | Apr 21, 2017 | Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form. | ||
| CVE-2016-1559 | Hig | 0.53 | 8.1 | 0.03 | Apr 21, 2017 | D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless passwords and administrative usernames and passwords over SNMP. | ||
| CVE-2016-1558 | Cri | 0.64 | 9.8 | 0.09 | Apr 21, 2017 | Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP-2660 1.11 and earlier, DAP-2690 3.15 and earlier, DAP-2695 1.16 and earlier, DAP-3320 1.00 and earlier, and DAP-3662 1.01 and… | ||
| CVE-2016-1557 | Cri | 0.64 | 9.8 | 0.03 | Apr 21, 2017 | Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP. | ||
| CVE-2016-1556 | Hig | 0.49 | 7.5 | 0.03 | Apr 21, 2017 | Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allows remote attackers to read the wireless WPS PIN or passphrase by visiting unauthenticated webpages. | ||
| CVE-2016-1555 | Cri | 0.87 | 9.8 | 0.98 | KEV | Apr 21, 2017 | (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands. | |
| CVE-2016-10091 | Hig | 0.49 | 7.5 | 0.03 | Apr 21, 2017 | Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to the (1) cmd_expand function, (2) cmd_emboss function, or (3) cmd_engrave function. | ||
| CVE-2016-0721 | Hig | 0.46 | 8.1 | 0.02 | Apr 21, 2017 | Session fixation vulnerability in pcsd in pcs before 0.9.157. | ||
| CVE-2016-0720 | Hig | 0.50 | 8.8 | 0.01 | Apr 21, 2017 | Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. | ||
| CVE-2017-7992 | Med | 0.40 | 6.1 | 0.01 | Apr 21, 2017 | Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter. | ||
| CVE-2016-4846 | Hig | 0.51 | 7.8 | 0.01 | Apr 21, 2017 | Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2. | ||
| CVE-2016-4841 | Med | 0.28 | 4.3 | 0.01 | Apr 21, 2017 | Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers. | ||
| CVE-2016-4840 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates. | ||
| CVE-2016-4832 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates. | ||
| CVE-2016-4830 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates. | ||
| CVE-2016-4829 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates. | ||
| CVE-2016-1194 | Med | 0.42 | 6.5 | 0.02 | Apr 21, 2017 | Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service. | ||
| CVE-2016-1184 | Med | 0.38 | 5.9 | 0.01 | Apr 21, 2017 | Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates. | ||
| CVE-2016-1148 | Hig | 0.53 | 8.1 | 0.01 | Apr 21, 2017 | Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates. | ||
| CVE-2016-0833 | Hig | 0.49 | 7.5 | 0.01 | Apr 21, 2017 | Android allows users to cause a denial of service. | ||
| CVE-2017-7951 | Hig | 0.57 | 8.8 | 0.01 | Apr 21, 2017 | WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context. | ||
| CVE-2017-7409 | Med | 0.40 | 6.1 | 0.01 | Apr 21, 2017 | Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674. | ||
| CVE-2017-7220 | Hig | 0.57 | 8.8 | 0.02 | Apr 21, 2017 | OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an… | ||
| CVE-2016-4075 | Med | 0.40 | 6.1 | 0.01 | Apr 21, 2017 | Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL. | ||
| CVE-2017-7990 | Hig | 0.57 | 8.8 | 0.01 | Apr 21, 2017 | The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp. | ||
| CVE-2017-6619 | Hig | 0.57 | 8.8 | 0.03 | Apr 20, 2017 | A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize… | ||
| CVE-2017-6618 | Med | 0.35 | 5.4 | 0.01 | Apr 20, 2017 | A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack. The vulnerability is due to insufficient validation of user-supplied input by the affected… |
- risk 0.64cvss 9.8epss 0.02
Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
- risk 0.49cvss 7.5epss 0.02
The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression with a repeating pattern.
- risk 0.47cvss 7.8epss 0.10
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
- risk 0.49cvss 7.5epss 0.02
Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information.
- risk 0.35cvss 5.3epss 0.01
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
- risk 0.59cvss 9.8epss 0.28
The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.
- risk 0.57cvss 9.8epss 0.02
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
- risk 0.57cvss 8.8epss 0.01
The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary code in the context of the kernel.
- risk 0.44cvss 7.8epss 0.03
Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
- risk 0.64cvss 9.8epss 0.06
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
- risk 0.58cvss 7.5epss 0.74
ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image.
- risk 0.72cvss 9.8epss 0.72
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.
- risk 0.51cvss 7.8epss 0.02
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.
- risk 0.38cvss 5.9epss 0.01
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.
- risk 0.53cvss 8.1epss 0.02
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs,…
- risk 0.38cvss 5.9epss 0.01
Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- risk 0.38cvss 5.9epss 0.01
The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- risk 0.38cvss 5.9epss 0.01
Photopt for Android before 2.0.1 does not verify SSL certificates.
- risk 0.44cvss 6.8epss 0.01
Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
- risk 0.38cvss 5.9epss 0.01
Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
- risk 0.68cvss 9.8epss 0.16
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands.
- risk 0.49cvss 7.5epss 0.01
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password.
- risk 0.42cvss 6.5epss 0.03
The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
- risk 0.28cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.
- risk 0.53cvss 8.1epss 0.03
D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless passwords and administrative usernames and passwords over SNMP.
- risk 0.64cvss 9.8epss 0.09
Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP-2660 1.11 and earlier, DAP-2690 3.15 and earlier, DAP-2695 1.16 and earlier, DAP-3320 1.00 and earlier, and DAP-3662 1.01 and…
- risk 0.64cvss 9.8epss 0.03
Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP.
- risk 0.49cvss 7.5epss 0.03
Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allows remote attackers to read the wireless WPS PIN or passphrase by visiting unauthenticated webpages.
- risk 0.87cvss 9.8epss 0.98
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
- risk 0.49cvss 7.5epss 0.03
Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to the (1) cmd_expand function, (2) cmd_emboss function, or (3) cmd_engrave function.
- risk 0.46cvss 8.1epss 0.02
Session fixation vulnerability in pcsd in pcs before 0.9.157.
- risk 0.50cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
- risk 0.40cvss 6.1epss 0.01
Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter.
- risk 0.51cvss 7.8epss 0.01
Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2.
- risk 0.28cvss 4.3epss 0.01
Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.
- risk 0.38cvss 5.9epss 0.01
Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates.
- risk 0.38cvss 5.9epss 0.01
WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
- risk 0.38cvss 5.9epss 0.01
Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
- risk 0.38cvss 5.9epss 0.01
DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.
- risk 0.42cvss 6.5epss 0.02
Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.
- risk 0.38cvss 5.9epss 0.01
Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
- risk 0.53cvss 8.1epss 0.01
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
- risk 0.49cvss 7.5epss 0.01
Android allows users to cause a denial of service.
- risk 0.57cvss 8.8epss 0.01
WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context.
- risk 0.40cvss 6.1epss 0.01
Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674.
- risk 0.57cvss 8.8epss 0.02
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an…
- risk 0.40cvss 6.1epss 0.01
Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL.
- risk 0.57cvss 8.8epss 0.01
The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.
- risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack. The vulnerability is due to insufficient validation of user-supplied input by the affected…