Simple Object Access Protocol Command Injection

Remote command injection vulnerabilities exist in multiple SOAP requests. A remote attacker can exploit these weaknesses to execute arbitrary commands in the affected devices via a crafted request...

Improper access control

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain...

CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

Improper access control

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

CVE-2018-12421

LTB aka LDAP Tool Box Self Service Password before 1.3 allows a change to a user password without knowing the old password via a crafted POST request, because the ldapbind return value is mishandled and the PHP data type is not constrained to be a string...

CVE-2017-3960

Exploitation of Authorization vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows authenticated users to gain elevated privileges via a crafted HTTP request parameter...

Microsoft SharePoint Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

CVE-2017-16224

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...

Improper access control

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

Quagga aspath_put BGP Session Drop Denial of Service (CVE-2017-16227)

A denial-of-service vulnerability exists in Quagga. The vulnerability is due to an improper calculation of ASPATH. A remote attacker can exploit this vulnerability by sending a specially crafted request to the affected service. Successful exploitation would cause the target to crash, resulting in...

dtSearch Stack Exhaustion Vulnerability

dtSearch is an application that makes it easy to search terabytes of text. The tool supports searching text on the desktop, network, LAN or INternet site. A stack exhaustion vulnerability exists in the search function of dtSearch 7.90.8538.1 and earlier versions. A remote attacker could exploit...

QNAP QTS Remote Command Injection (CVE-2013-0143)

Remote command injection vulnerabilities exist in QNAP QTS. A remote attacker can exploit these weaknesses to execute arbitrary commands in the affected devices via a crafted request...

VMware Workstation ghi update Null Pointer Dereference Denial of Service Vulnerability

This vulnerability allows local attackers to deny service on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on a guest OS in order to exploit this vulnerability. The specific flaw exists within the ghi.guest.trayIcon.update...

The vulnerability of the Qualcomm operating system Android component, which allows a hacker to trigger memory corruption

The vulnerability of the Qualcomm Android operating system arises from operations that occur outside the buffer in memory when processing requests through the QDI interface. Exploiting this vulnerability allows a malicious actor to trigger memory corruption by using a specially crafted request...

Null pointer dereference

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck. A crafted request...

CVE-2017-14435

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXA\CFG.ini" without a cookie heade...

Apache Solr Data Import Handler XML External Entity Expansion Information Disclosure (CVE-2018-1308)

An XML external entity expansion vulnerability has been reported in Apache Solr. The vulnerability is due to improper handling of XML external entities in XML content submitted to the DataImportHandler. A remote attacker can exploit this vulnerability by submitting a crafted request to the target...

PT-2018-5365 · Moxa · Moxa Edr-810

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 version 4.1 build 17030317 Description: A denial of service issue exists in the web server functionality. It can be triggered by a specially crafted HTTP URI, causing a null pointer dereference that results in the web server...

Red Hat 389-ds-base Denial of Service Vulnerability (CNVD-2018-09316)

Red Hat 389-ds-base is an American Red Hat package that includes a Linux directory server and a server administration command-line program. A security vulnerability exists in Red Hat 389-ds-base versions prior to 1.4.0.9, prior to 1.3.8.1, and prior to 1.3.6.15. A remote attacker could cause a...

IBM Security QRadar SIEM Remote Code Execution Vulnerability

IBM Security QRadar SIEM applies security intelligence and perceptual analytics by consolidating, normalizing and correlating log and stream data to help prioritize security events and stay away from advanced threats. A security vulnerability exists in IBM Security QRadar SIEM that allows a remot...