20 vulnerabilidades · Networking · ⚡ Nuclei Orden: CVSS EPSS Año ID
CVE-2019-12989
🔥 KEV Software Genérico Networking Database ⚡ nuclei
9.8
CRITICAL
EPSS
91.5%
2019 2 PoCs

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

Scanner Automatizado
nuclei -t CVE-2019-12989.yaml ⎘
CVE-2019-1821
Cisco Prime Infrastructure Networking ⚡ nuclei
8.8
HIGH
EPSS
94.0%
2019 CWE-20 1 PoC

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.

Scanner Automatizado
nuclei -t CVE-2019-1821.yaml ⎘
CVE-2019-7481
🔥 KEV SMA100 Networking ⚡ nuclei
7.5
HIGH
EPSS
94.3%
2019 CWE-89 0 PoCs

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.

Scanner Automatizado
nuclei -t CVE-2019-7481.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2019-13608
🔥 KEV Software Genérico Networking ⚡ nuclei
7.5
HIGH
EPSS
71.3%
2019 0 PoCs

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

Scanner Automatizado
nuclei -t CVE-2019-13608.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2019-1653
🔥 KEV Cisco Small Business RV Series Router Firmware Web Networking ⚡ nuclei
7.5
HIGH
EPSS
94.4%
2019 CWE-284 17 PoCs

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.

Scanner Automatizado
nuclei -t CVE-2019-1653.yaml ⎘
CVE-2019-5591
🔥 KEV Fortinet FortiOS Networking Windows ⚡ nuclei
6.5
MEDIUM
EPSS
48.4%
2019 0 PoCs

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.

Scanner Automatizado
nuclei -t CVE-2019-5591.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2019-1898
Cisco RV130W Wireless-N Multifunction VPN Router Firmware Web Networking ⚡ nuclei
5.3
MEDIUM
EPSS
78.7%
2019 CWE-285 1 PoC

A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing the URL for the syslog file. A successful exploit could allow the attacker to access the information contained in the file.

Scanner Automatizado
nuclei -t CVE-2019-1898.yaml ⎘
CVE-2019-17506
Software Genérico Web Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
93.8%
2019 0 PoCs

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.

Scanner Automatizado
nuclei -t CVE-2019-17506.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2019-19824
Software Genérico Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
89.5%
2019 3 PoCs

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.

Scanner Automatizado
nuclei -t CVE-2019-19824.yaml ⎘
CVE-2019-16313
Software Genérico Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
94.0%
2019 0 PoCs

ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.

Scanner Automatizado
nuclei -t CVE-2019-16313.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2019-12986
Software Genérico Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
91.8%
2019 1 PoC

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6).

Scanner Automatizado
nuclei -t CVE-2019-12986.yaml ⎘
CVE-2019-19825
Software Genérico Web Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
18.6%
2019 3 PoCs

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

Scanner Automatizado
nuclei -t CVE-2019-19825.yaml ⎘
CVE-2019-12988
Software Genérico Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
91.7%
2019 1 PoC

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).

Scanner Automatizado
nuclei -t CVE-2019-12988.yaml ⎘
CVE-2019-9955
Software Genérico Web Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
10.7%
2019 2 PoCs

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.

Scanner Automatizado
nuclei -t CVE-2019-9955.yaml ⎘
CVE-2019-12985
Software Genérico Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
91.3%
2019 1 PoC

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6).

Scanner Automatizado
nuclei -t CVE-2019-12985.yaml ⎘
CVE-2019-12987
Software Genérico Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
91.7%
2019 1 PoC

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).

Scanner Automatizado
nuclei -t CVE-2019-12987.yaml ⎘
CVE-2019-12990
Software Genérico Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
91.2%
2019 1 PoC

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.

Scanner Automatizado
nuclei -t CVE-2019-12990.yaml ⎘
CVE-2019-19823
Software Genérico Web Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
28.7%
2019 3 PoCs

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-1

Scanner Automatizado
nuclei -t CVE-2019-19823.yaml ⎘
CVE-2019-19822
Software Genérico Web Networking ⚡ nuclei
N/A
UNKNOWN
EPSS
54.1%
2019 3 PoCs

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; H

Scanner Automatizado
nuclei -t CVE-2019-19822.yaml ⎘