Category
Network devices
11,275 known vulnerabilities.
296 results · Clear filters · Feed
-
Low 2.0
Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the a…
-
Low 1.3
PAN-OS: Improper Validation of Terminal Server Agent Certificate
An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even if the PAN-OS configuration would not normally permit them to do so.
-
Low 3.8
An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS…
-
Low 3.2
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as ex…
-
Low 3.1
BIG-IP Configuration utility vulnerability
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Low 3.3
BIG-IP Edge Client for Windows vulnerability
A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
Low 2.4
D-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting
A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. T…
-
Low 2.4
D-Link DSL-6641K Web ad_virtual_server_vdsl cross site scripting
A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interface. Performing a manipulation of the argument Name results in cross site scripting. It is possible to…
-
Low 3.7
D-Link DIR-823X Login sub_40AC74 excessive authentication
A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the component Login. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote.…
-
Low 2.4
D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal
A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. The manipulation of the argument UploadMusic leads to path traversal. The attac…
-
Low 2.1
Password Confirmation Bypass in Omada Controller
Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password without proper confirmation, leading to weakened account security.
-
Low 3.4
A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4…
-
Low 1.1
Insufficient input validation in NETGEAR Orbi routers
An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.
-
Low 3.5
D-Link DCS-850L Firmware Update Service uploadfirmware path traversal
A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the argument DownloadFile results in path traversal. The attack must originate from the local network. …
-
Low 2.6
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all…
-
Low 2.6
A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticat…
-
Low 2.4
Improper input validation in NETGEAR Nighthawk router R7000P
An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router…
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 1.7
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS…
-
Low 3.8
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5…
-
Low 3.9
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 al…
-
Low 3.9
An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3…
-
Low 1.1
Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser
An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this…
-
Low 1.1
Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser
An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.
-
Low 0.5
Credentials recorded in logs in NETGEAR WAX610 and WAX610Y
Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points). An user having access to the syslog server can read the logs containing …
-
Low 2.6
A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 a…
-
Low 2.5
An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, F…
-
Low 2.5
An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect a…
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect a…
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect a…
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect a…
-
Low 2.8
Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service…
-
Low 2.4
Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troublesho…
-
Low 3.4
An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privile…
-
Low 3.8
On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c
On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-conf…
-
Low 3.5
D-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scripting
A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Address Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be in…