369 matches found
CVE-2019-13273
In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. The overflow may be exploited by sending a crafted GET request that triggers an sprintf of the srcdb parameter...
CVE-2018-17211
An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request...
The vulnerability in the “One Portal for Housing Fund Monitoring” platform, related to insufficient verification of access rights, allows a violator to gain access to protected information.
The vulnerability in the “One Portal for Housing Fund Monitoring” platform is related to insufficient verification of access rights. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information through a specially crafted GET request...
Directory traversal
Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...
CVE-2018-1000817
Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...
ADB Epicentro Buffer Overflow Vulnerability (CNVD-2018-20873 )
ADB Epicentro is a set of firmware used in ADB gateway and router devices from ADB Switzerland. httpd is one of the HTTP servers. A buffer overflow vulnerability exists in httpd in ADB Epicentro version E7.3.2+. A remote attacker could exploit this vulnerability to execute code with the help of a...
CVE-2018-7632
Buffer Overflow in httpd in EpiCentro E7.3.2+ allows attackers to cause a denial of service attack remotely via a specially crafted GET request with a leading "/" in the URL...
CVE-2018-7631
Buffer Overflow in httpd in EpiCentro E7.3.2+ allows attackers to execute code remotely via a specially crafted GET request without a leading "/" and without authentication...
CVE-2018-1000525
openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Specially crafted GET request variable containing serialised PHP object. This...
IPConfigure Orchid VMS 2.0.5 Directory Traversal / Information Disclosure
require 'msf/core' class MetasploitModule 'IPConfigure Orchid VMS %q Orchid Core VMS is vulnerable to a directory traversal attack. This affects Linux and Windows operating systems. This allows a remote, unauthenticated attacker to send crafted GET requests to the application, which results in th...
IPConfigure Orchid VMS 2.0.5 - Directory Traversal / Information Disclosure (Metasploit)
require 'msf/core' class MetasploitModule 'IPConfigure Orchid VMS %q Orchid Core VMS is vulnerable to a directory traversal attack. This affects Linux and Windows operating systems. This allows a remote, unauthenticated attacker to send crafted GET requests to the application, which results in th...
Foscam Foscam Camera Arbitrary File Deletion Vulnerability
FOSCAM, the safe life brand of Shenzhen FOSCAM Intelligent Technology Co., Ltd, covers network video surveillance products network cameras, hard disk recorders, surveillance kits, video cloud storage services and so on. The Foscam Foscam Camera Arbitrary File Deletion vulnerability allows an...
Node.js third-party modules: [lactate] Static Web Server Directory Traversal via Crafted GET Request
Hi @vdeturckheim, A crafted GET request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. Module specification Name: lactate Version: 0.13.12 latest release build Verified conditions...
Node.js third-party modules: [augustine] Static Web Server Directory Traversal via Crafted GET Request
Hi, A crafted GET request can be leveraged to traverse the directory structure of a host using the augustine web server package, and request arbitrary files outside of the specified web root. Module specification Name: augustine Version: 0.2.3 latest release build Verified conditions Test server:...
Node.js third-party modules: [serve-here] Static Web Server Directory Traversal via Crafted GET Request
Hi, A crafted GET request can be leveraged to traverse the directory structure of a host using the serve-here web server package, and request arbitrary files outside of the specified web root. Module specification Name: serve-here Version: 3.2.0 latest release build Verified conditions Test serve...
CVE-2017-16923
Command Injection vulnerability in appdatacenter on Shenzhen Tenda Ac9 USAC9V1.0BRV15.03.05.14multiTD01, Ac9 ac9kfV15.03.05.196318cn, Ac15 USAC15V1.0BRV15.03.05.18multiTD01, Ac15 USAC15V1.0BRV15.03.05.19multiTD01, Ac18 USAC18V1.0BRV15.03.05.05multiTD01, and Ac18 ac18kfV15.03.05.196318cn devices...
Carel PlantVisor 2.4.4 Directory Traversal
require 'msf/core' class MetasploitModule 'Carel Pl@ntVisor Directory Traversal', 'Description' = %q This module exploits a directory traversal vulnerability found in Carel Pl@ntVisor 'james fitts' , 'License' = MSFLICENSE, 'References' = 'CVE', '2011-3487' , 'BID', '49601' , , 'DisclosureDate' =...
CVE-2017-13708
Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GET request...