ui Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/ui/ Sun, 26 Feb 2023 06:50:16 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png ui Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/ui/ 32 32 CVE-2018-5265 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5265/ Sun, 26 Feb 2023 06:50:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5265/ Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the ‘alias’ or ‘ips’ parameter for shell metacharacters.

The post CVE-2018-5265 appeared first on CVE Vulnerability.

]]> Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the ‘alias’ or ‘ips’ parameter for shell metacharacters.

The post CVE-2018-5265 appeared first on CVE Vulnerability.

]]> CVE-2018-12590 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12590/ Sun, 26 Feb 2023 06:45:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12590/ Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.

The post CVE-2018-12590 appeared first on CVE Vulnerability.

]]> Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.

The post CVE-2018-12590 appeared first on CVE Vulnerability.

]]> CVE-2020-8232 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8232/ Sun, 26 Feb 2023 06:43:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8232/ An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.

The post CVE-2020-8232 appeared first on CVE Vulnerability.

]]> An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.

The post CVE-2020-8232 appeared first on CVE Vulnerability.

]]> CVE-2020-8233 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8233/ Sun, 26 Feb 2023 06:43:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8233/ A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.

The post CVE-2020-8233 appeared first on CVE Vulnerability.

]]> A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.

The post CVE-2020-8233 appeared first on CVE Vulnerability.

]]> CVE-2020-8234 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8234/ Sun, 26 Feb 2023 06:43:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8234/ A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection.

The post CVE-2020-8234 appeared first on CVE Vulnerability.

]]> A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection.

The post CVE-2020-8234 appeared first on CVE Vulnerability.

]]> CVE-2020-8170 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8170/ Sun, 26 Feb 2023 06:43:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8170/ We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user’ session information […]

The post CVE-2020-8170 appeared first on CVE Vulnerability.

]]> We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user’ session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.

The post CVE-2020-8170 appeared first on CVE Vulnerability.

]]> CVE-2020-8171 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8171/ Sun, 26 Feb 2023 06:43:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8171/ We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input […]

The post CVE-2020-8171 appeared first on CVE Vulnerability.

]]> We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.

The post CVE-2020-8171 appeared first on CVE Vulnerability.

]]> CVE-2020-8168 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8168/ Sun, 26 Feb 2023 06:43:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8168/ We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be […]

The post CVE-2020-8168 appeared first on CVE Vulnerability.

]]> We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device’s firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.

The post CVE-2020-8168 appeared first on CVE Vulnerability.

]]> CVE-2019-5445 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-5445/ Sun, 26 Feb 2023 06:33:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-5445/ DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.

The post CVE-2019-5445 appeared first on CVE Vulnerability.

]]> DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.

The post CVE-2019-5445 appeared first on CVE Vulnerability.

]]> CVE-2019-5446 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-5446/ Sun, 26 Feb 2023 06:33:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-5446/ Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.

The post CVE-2019-5446 appeared first on CVE Vulnerability.

]]> Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.

The post CVE-2019-5446 appeared first on CVE Vulnerability.

]]>