Endian vulnerabilities and threats

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of the /manage/password/web/ endpoint. An authenticated attacker can inject arbitrary JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1. No patch or official remediation information is currently provided. There are no known exploits in the wild at this time.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability via the new_cert_name parameter in the /manage/ca/certificate/ page. An authenticated attacker can inject arbitrary JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and earlier contain a stored cross-site scripting (XSS) vulnerability in the remark parameter of the /manage/vpnauthentication/user/ endpoint. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users access the affected page. This vulnerability has a medium severity with a CVSS 4.0 base score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of the /manage/dnsmasq/localdomains/ page. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity rating with a CVSS score of 5.1. No patch or official fix information is currently provided for this vulnerability.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the ADDRESS BCC parameter of /cgi-bin/smtprouting.cgi. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users access the affected page. This vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1. No patch or official remediation guidance is currently provided in the available data.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the domain parameter of the /manage/smtpscan/domainrouting/ endpoint. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity with a CVSS 4.0 base score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the DOMAIN parameter of /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject malicious JavaScript code that is stored on the server and executed when other users access the affected page. This vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the /cgi-bin/proxyuser.cgi endpoint via the user parameter. An attacker with authenticated access can inject malicious JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity with a CVSS 4.0 base score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the mimetypes parameter of /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject malicious JavaScript code that is stored on the server and executed when other users access the affected page. This vulnerability has a CVSS 4.0 base score of 5.1, indicating a medium severity level. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of /cgi-bin/xtaccess.cgi. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity with a CVSS score of 5.1. No patch or official fix information is currently provided for this issue.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of /cgi-bin/vpnfw.cgi. An authenticated attacker can inject malicious JavaScript code that is stored on the server and executed when other users view the affected page. This vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of /cgi-bin/zonefw.cgi. An authenticated attacker can inject malicious JavaScript code that is stored on the system and executed when other users view the affected page. This vulnerability has a medium severity rating with a CVSS score of 5.1.

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of /cgi-bin/incoming.cgi. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity rating with a CVSS 4.0 base score of 5.1. No official patch or remediation information is provided in the available data. There are no known exploits in the wild at this time.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of /cgi-bin/snat.cgi. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users view the affected page. This vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability in the remark parameter of /cgi-bin/dnat.cgi. An authenticated attacker can inject malicious JavaScript code that is stored and executed when other users access the affected page. This vulnerability has a medium severity with a CVSS 4.0 score of 5.1. No official patch or remediation information is provided in the available data.

Endian Firewall version 3.3.25 and earlier contains a stored cross-site scripting (XSS) vulnerability via the dscp parameter in the /manage/qos/rules/ page. An authenticated attacker can inject malicious JavaScript code that is stored on the server and executed when other users view the affected page. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.1. No patch or official fix information is currently provided.