218 vulnerabilidades · Networking Orden: CVSS EPSS Año ID
CVE-2021-47827
WebSSH for iOS Networking
4.6
MEDIUM
EPSS
0.0%
2021 CWE-1284 1 PoC

WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can trigger the vulnerability by copying a 300-character buffer of repeated 'A' characters into the mashREPL input field, causing the application to crash.

Scanner Automatizado
Sin template local disponible
CVE-2021-3031
PAN-OS Networking
4.3
MEDIUM
EPSS
0.1%
2021 CWE-200 1 PoC

Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets. This issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001. This issue impacts: PAN-OS 8.1 version earlier than PAN-OS

Scanner Automatizado
Sin template local disponible
CVE-2021-4425
Defender Security – Malware Scanner, Login Security & Firewall Web Networking Windows
4.3
MEDIUM
EPSS
0.2%
2021 CWE-352 7 PoCs

The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Scanner Automatizado
Sin template local disponible
CVE-2021-36368
Software Genérico Networking
3.7
LOW
EPSS
1.7%
2021 1 PoC

An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.

Scanner Automatizado
Sin template local disponible
CVE-2021-44168
🔥 KEV Fortinet FortiOS Networking
3.3
LOW
EPSS
1.1%
2021 1 PoC

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.

Scanner Automatizado
Sin template local disponible
CVE-2021-34563
WHA-GW-F2D2-0-AS- Z2-ETH Web Networking
3.3
LOW
EPSS
0.0%
2021 CWE-1004 1 PoC

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.

Scanner Automatizado
Sin template local disponible
CVE-2021-4240
phpservermon Web Networking
2.6
LOW
EPSS
0.2%
2021 CWE-331 2 PoCs

A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is 3daa804d5f56c55b3ae13bfac368bb84ec632193. It is recommended to apply a patch to fix this issue. The identifier VDB-213717 was assigned to this vulnerability.

Scanner Automatizado
Sin template local disponible
CVE-2021-36282
PowerScale OneFS Networking
2.5
LOW
EPSS
0.1%
2021 1 PoC

Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges to gain access up to 24 bytes of data within the /ifs kernel stack under certain conditions.

Scanner Automatizado
Sin template local disponible
CVE-2021-33964
Software Genérico Web Networking
N/A
UNKNOWN
EPSS
2.9%
2021 1 PoC

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST request, and the parameter firewall_level has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.

Scanner Automatizado
Sin template local disponible
CVE-2021-31606
Software Genérico Networking
N/A
UNKNOWN
EPSS
2.5%
2021 1 PoC

furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.

Scanner Automatizado
Sin template local disponible
CVE-2021-44827
Software Genérico Web Networking
N/A
UNKNOWN
EPSS
54.0%
2021 3 PoCs

There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges.

Scanner Automatizado
Sin template local disponible
CVE-2021-42230
Software Genérico Networking
N/A
UNKNOWN
EPSS
6.3%
2021 2 PoCs

Seowon 130-SLC router all versions as of 2021-09-15 is vulnerable to Remote Code Execution via the queriesCnt parameter.

Scanner Automatizado
Sin template local disponible
CVE-2021-43399
Software Genérico Networking
N/A
UNKNOWN
EPSS
1.4%
2021 1 PoC

The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHSM 2 device.

Scanner Automatizado
Sin template local disponible
CVE-2021-34203
Software Genérico Networking
N/A
UNKNOWN
EPSS
1.2%
2021 2 PoCs

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify routing information, monitor the traffic of all devices under the router, hijack DNS and phishing attacks. In addition, this interface is likely to be questioned by customers as a backdoor, because the interface should not be exposed.

Scanner Automatizado
Sin template local disponible
CVE-2021-43163
Software Genérico Web Networking
N/A
UNKNOWN
EPSS
2.1%
2021 1 PoC

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth.

Scanner Automatizado
Sin template local disponible
CVE-2021-35523
Software Genérico Networking Windows
N/A
UNKNOWN
EPSS
0.7%
2021 1 PoC

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.

Scanner Automatizado
Sin template local disponible
CVE-2021-27403
Software Genérico Web Networking
N/A
UNKNOWN
EPSS
1.2%
2021 1 PoC

Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.

Scanner Automatizado
Sin template local disponible
CVE-2021-43728
Software Genérico Web Networking
N/A
UNKNOWN
EPSS
0.6%
2021 1 PoC

Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized SSID parameter.

Scanner Automatizado
Sin template local disponible
CVE-2021-32402
Software Genérico Web Networking
N/A
UNKNOWN
EPSS
0.5%
2021 1 PoC

Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.

Scanner Automatizado
Sin template local disponible
CVE-2021-27692
Software Genérico Networking
N/A
UNKNOWN
EPSS
3.2%
2021 2 PoCs

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the "doSystemCmd" function with untrusted input.

Scanner Automatizado
Sin template local disponible