Category
Network devices
11,174 known vulnerabilities.
133 results · Clear filters · Feed
-
Critical 10.0
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbi…
KEV Apr 12, 2024 -
High 7.3
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Requ…
KEV Apr 11, 2024 -
Critical 9.8
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the co…
KEV Apr 11, 2024 -
Critical 9.3
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS versi…
KEV Mar 25, 2024 -
Critical 9.8
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0…
KEV Oct 9, 2024 -
Critical 9.6
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0…
KEV Feb 9, 2024 -
High 8.2
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Polic…
KEV Jan 31, 2024 -
High 8.2
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a r…
KEV Jan 10, 2024 -
Critical 9.1
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,…
KEV Jan 10, 2024 -
Critical 9.8
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have …
KEV Oct 31, 2023 -
High 7.2
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject …
KEV Oct 23, 2023 -
Critical 10.0
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IO…
KEV Oct 16, 2023 -
Critical 9.4
Unauthenticated sensitive information disclosure
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
KEV Oct 18, 2023 -
Critical 9.8
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an…
KEV Aug 22, 2023 -
Medium 5.3
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't re…
KEV Nov 13, 2023 -
Critical 9.8
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker …
KEV Nov 13, 2023 -
Medium 5.3
Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify …
KEV Nov 13, 2023 -
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted f…
KEV Jan 18, 2024 -
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or r…
KEV Jul 25, 2023 -
Critical 9.8
Unauthenticated remote code execution
KEV Jul 19, 2023 -
Critical 9.8
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…
KEV Aug 16, 2023 -
Critical 9.2
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, vers…
KEV Jun 13, 2023 -
Critical 9.8
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware ver…
KEV May 31, 2023 -
Critical 9.8
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.1…
KEV Nov 16, 2023 -
Critical 9.3
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…
KEV Dec 13, 2022 -
Critical 9.8
Unauthenticated remote arbitrary code execution
Unauthenticated remote arbitrary code execution
KEV Dec 13, 2022 -
Critical 9.8
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…
KEV Oct 11, 2022 -
Critical 9.8
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…
KEV May 16, 2022 -
Critical 9.8
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…
KEV May 10, 2022 -
Critical 9.8
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…
KEV Mar 31, 2022 -
Critical 10.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Low 3.3
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0…
KEV Dec 10, 2021 -
Critical 9.8
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…
KEV Jan 28, 2022 -
Critical 9.8
Cisco HyperFlex HX Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…
KEV Nov 3, 2021 -
Critical 9.8
Cisco HyperFlex HX Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…
KEV Nov 3, 2021 -
Critical 9.8
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…
KEV Nov 3, 2021 -
Medium 6.1
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against …
KEV Nov 3, 2021 -
High 7.8
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to ha…
KEV Oct 24, 2022 -
Medium 6.5
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …
KEV Nov 3, 2021 -
High 7.5
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files…
KEV Nov 3, 2021