UBUNTU-CVE-2023-38313

An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a dobinauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS a Denial-of-Service condition...

The vulnerability of the IBM TXSeries transaction application management software for multiple platforms is related to an implementation error in Angular templates, which allows attackers to trigger a service failure.

The vulnerability of the IBM TXSeries transaction application management software for multiple platforms is related to an implementation error in Angular templates. Exploiting this vulnerability can allow a malicious actor to trigger a service failure through a specially crafted request...

Command injection

OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlier allows a network-adjacent authenticated user to execute an arbitrary OS command by sending a specially crafted request...

CVE-2023-43752

OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlier allows a network-adjacent authenticated user to execute an arbitrary OS command by sending a specially crafted request...

The vulnerability of the Guardium Cloud Key Manager (CKM), a data encryption software from IBM Guardium, allows a perpetrator to execute arbitrary code.

The vulnerability of the Guardium Cloud Key Manager CKM, a data encryption software from IBM Guardium, exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially create...

Design/Logic Flaw

An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request to the MQTT component...

golang: net/http, net/textproto: denial of service from excessive memory allocation

A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service...

CVE-2023-42326

An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfacesgifedit.php and interfacesgreedit.php components...

CVE-2023-42326

An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfacesgifedit.php and interfacesgreedit.php components...

CVE-2023-47609

SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request...

CVE-2023-42326

An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfacesgifedit.php and interfacesgreedit.php components...

PT-2023-6967

Name of the Vulnerable Software and Affected Versions ASP.NET affected versions not specified Description The issue is related to errors in security settings of the Microsoft .NET Framework platform. It allows a remote attacker to access a closed part of a web application by sending a specially...

ELECOM WRC-X3000GS2-W Security Vulnerability

The ELECOM WRC-X3000GS2-W is a wireless router from ELECOM. A security vulnerability exists in the ELECOM WRC-X3000GS2-W that originates from a logged-in user being able to execute arbitrary operating system commands by sending a specially crafted request...

VulnCheck KEV: CVE-2022-31126

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before...

PT-2023-9505 · Cisco · Cisco Small Business Rv042G +3

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV042, RV042G, RV320, and RV325 Routers affected versions not specified Description: The issue is related to improper validation of user input in incoming HTTP packets, which could allow a remote attacker to cause an...

golang: net/http, net/textproto: denial of service from excessive memory allocation

A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service...

golang: net/http, net/textproto: denial of service from excessive memory allocation

A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service...

CVE-2023-5969

Mattermost fails to properly sanitize the request to /api/v4/redirectlocation allowing an attacker, sending a specially crafted request to /api/v4/redirectlocation, to fill up the memory due to caching large items...

Security Bulletin: CVE-2023-38737 affects IBM WebSphere Liberty shipped with IBM CICS TX Standard

Summary CVE-2023-38737 affects IBM WebSphere Liberty shipped with IBM CICS TX Standard. IBM CICS TX Standard has addressed the applicable vulnerability. Vulnerability Details CVEID:CVE-2023-38737 DESCRIPTION: IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a...

The vulnerability of the /v1/avatars/favicon component of the backend platform for developing mobile and web applications allows a attacker to perform an SSRF attack.

The vulnerability of the /v1/avatars/favicon component in the backend platform for developing mobile and web applications relates to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using a specially crafted GET request...