NETGEAR N300 Denial of Service Vulnerability

The NETGEAR N300 is a wireless router from NETGEAR. A security vulnerability exists in the session handling function in the HTTP server of the NETGEAR N300 WNR2000v5 using firmware version 1.0.0.70. An attacker can exploit the vulnerability to cause the HTTP service to crash with the help of an...

Server side request forgery (ssrf)

A vulnerability in Cisco Unified Contact Center Express Unified CCX could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF attack on a targeted system. The vulnerability is due to improper validation of user-supplied input on the...

CVE-2019-12633 Cisco Unified Contact Center Express Request Processing Server-Side Request Forgery Vulnerability

A vulnerability in Cisco Unified Contact Center Express Unified CCX could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF attack on a targeted system. The vulnerability is due to improper validation of user-supplied input on the...

Varnish Cache Denial of Service Vulnerability

Varnish Cache is a set of reverse web caching servers. A security vulnerability exists in Varnish Cache versions prior to 6.0.4 LTS, 6.1.x, and 6.2.x prior to 6.2.1. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/1 request to cause a denial of service automat...

The vulnerability of the web server of the Cisco Integrated Management Controller, a software-based remote management system for servers, allows a perpetrator to increase their privileges.

The vulnerability of the Cisco Integrated Management Controller, a software-based remote server management system, is related to errors in processing substring comparisons. Exploiting this vulnerability can allow an attacker to increase their privileges through a specially crafted HTTP request...

The vulnerability of the SSL VPN web portal of the operating system FortiOS allows a hacker to gain access to system files.

The vulnerability of the SSL VPN web portal of the operating system FortiOS exists due to an incorrect path limitation to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain access to system files by sending a specially crafted HTTP request...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

Integer overflow

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

CVE-2019-13126

CVE-2019-13126 is an integer overflow in the NATS Server prior to 2.0.2 that allows a remote attacker to crash the server by sending a crafted request; if authentication is enabled, the attacker must have authenticated first. Public notices extend risk to later versions (e.g., GHSA references for...

The vulnerability of the Windows operating system’s DNS server, related to errors in processing DNS requests, allows a perpetrator to cause a service failure.

The vulnerability of the Windows operating system’s DNS server is related to errors in processing DNS requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted request...

CVE-2019-14243

headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service webserver panic and daemon crash via a crafted HAProxy PROXY v2 request with truncated source/destinatio...

Eclipse Foundation Mosquitto Pattern Based ACL Bypass (CVE-2017-7650)

An ACL bypass vulnerability has been reported in Eclipse Foundation Mosquitto. A remote user can exploit this vulnerability by sending a crafted request to the target server...

The vulnerability of the Microsoft SharePoint software package arises from insufficient cleaning of data provided by users, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the Microsoft SharePoint software package is related to insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute cross-site scripting attacks with elevated privileges using a specially created...

The vulnerability relates to the set of tools for developing software for collaborative work within Azure DevOps Server and the Project Management and Version Control system Team Foundation Server. It stems from the lack of measures for cleaning input data, allowing a malicious actor to execute arbitrary code in the context of the current user.

The vulnerability of the Azure DevOps Server and Team Foundation Server project management and version control systems relates to the lack of measures for input data cleansing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, by...

Arbitrary command execution in slanger

A remote attacker can execute arbitrary commands by sending a crafted request to the server. This is due to the use of Oj.load instead of Oj.strictload when processing messages. Note that slanger is no longer maintained...

Design/Logic Flaw

Slanger 0.6.0 is affected by: Remote Code Execution RCE. The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after...

The vulnerability of the Cockpit server manager, caused by an operation going beyond buffer boundaries in memory, allows a attacker to trigger a service failure.

The vulnerability of the Cockpit server administrator arises from an operation that occurs outside the buffer boundaries of memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause a service failure by sending a specially crafted request along with a specially...

The vulnerability in the platform for creating a unified database and electronic registration of residential properties, “BAR.- ”, is related to insufficient protection of the website structure, allowing a perpetrator to execute arbitrary JavaScript code.

The vulnerability in the platform for creating a unified database and electronic registration of residential properties, “BAR.- ”, is related to insufficient protection of the website’s structure. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary JavaScrip...