Authentication flaw

The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script, which allows remote attackers to obtain sensitive information by downloading a .tgz file...

Kerio WinRoute Firewall Web Server < 6 - Source Code Disclosure

Exploit Title: Kerio WinRoute Firewall Embedded Web ServerVersion: Source Code Disclosure Google Dork: Date: 10.05.2012 Author: Eugene Salov, Andrey Komarov Group-IB, http://group-ib.ru Software Link: http://winroute.ru/keriowinroutefirewall.htm Version: prior to 6 Tested on: Microsoft Windows CV...

iGuard Security Access Control Device Firmware 3.6.7427A - Cross-Site Scripting

iGuard Security Access Control Device Firmware 3.6.7427A - Cross-Site Scripting source: https://www.securityfocus.com/bid/53355/info iGuard Security Access Control is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input in the embedded web server...

iGuard Security Access Control System Cross Site Scripting

Tile ==== iGuard Security Access Control System Webserver, Cross Site Scripting XSS Author ====== Usman Saeed , Xc0re Security Research Group Website : http://www.xc0re.net Twitter : http://twitter.com/xc0resecurity Blog : http://www.xc0re.net/blog Published :...

Debian DSA-2420-1 : openjdk-6 - several vulnerabilities

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform. - CVE-2011-3377 The IcedTea browser plugin included in the openjdk-6 package does not properly enforce the Same Origin Policy on web content served under a domain name which has a common suffix...

Mutant 200s tuner directory traversal

Directory traversal in embedded web server...

ThinVNC / ThinRDP directory traversal

Directory traversal in embedded web server...

Metropolis Technologies OfficeWatch directory traversal

Embedded web server directory traversal...

CVE-2011-2900

Stack-based buffer overflow in the 1 putdir function in mongoose.c in Mongoose 3.0, 2 putdir function in yasslEWS.c in yaSSL Embedded Web Server yasslEWS 0.2, and 3 shttpdputdir function in iodir.c in Simple HTTPD shttpd 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT...

Stack overflow

Stack-based buffer overflow in the 1 putdir function in mongoose.c in Mongoose 3.0, 2 putdir function in yasslEWS.c in yaSSL Embedded Web Server yasslEWS 0.2, and 3 shttpdputdir function in iodir.c in Simple HTTPD shttpd 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT...

CVE-2011-2900

CVE-2011-2900 is a stack-based buffer overflow in the HTTP PUT handling paths of Mongoose 3.0, yaSSL Embedded Web Server (yasslEWS) 0.2, and Simple HTTPD (shttpd) 1.42, allowing remote code execution. The root cause is a vulnerable put_dir/ _shttpd_put_dir path in mongoose.c, yasslEWS.c, and io_d...

CVE-2011-2900

Stack-based buffer overflow in the 1 putdir function in mongoose.c in Mongoose 3.0, 2 putdir function in yasslEWS.c in yaSSL Embedded Web Server yasslEWS 0.2, and 3 shttpdputdir function in iodir.c in Simple HTTPD shttpd 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT...

CVE-2011-1531

The webscan component in the Embedded Web Server EWS on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310, Fax All-in-One, and C510; and ENVY 100 D410 printers allows remote attackers to read documents on the scan surface via unspecified vectors...

CVE-2011-1532

Unspecified vulnerability in the SNMP component on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310, Fax All-in-One, and C510; and ENVY 100 D410 printers allows remote attackers to obtain sensitive information or modify data via vectors related to the Embedded Web...

Code injection

The webscan component in the Embedded Web Server EWS on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310, Fax All-in-One, and C510; and ENVY 100 D410 printers allows remote attackers to read documents on the scan surface via unspecified vectors...

Code injection

Unspecified vulnerability in the SNMP component on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310, Fax All-in-One, and C510; and ENVY 100 D410 printers allows remote attackers to obtain sensitive information or modify data via vectors related to the Embedded Web...

CVE-2011-1531

The CVE-2011-1531 issue affects the webscan component of the Embedded Web Server (EWS) in HP Photosmart D110/B110, Plus B210, Premium C310/Fax All-in-One/C510, and ENVY 100 D410 printers. The vulnerability allows remote attackers to read documents on the scan surface via unspecified vectors. Root...

CVE-2011-0344

Multiple stack-based buffer overflows in unspecified CGI programs in the Unified Maintenance Tool web interface in the embedded web server in the Communication Server CS in Alcatel-Lucent OmniPCX Enterprise before R9.0 H1.301.50 allow remote attackers to execute arbitrary code via crafted HTTP...

Dlink WBR-2310 Embedded Web Server 1.04 Denial Of Service

DCA-00014 Software - Dlink WBR-2310 Embedded Web Server Vendor Product Description - The D-Link RangeBooster G™ WBR-2310 with enhanced 108 features the industry’s first default 108Mbps “Dynamic Mode” that allows clients to always operate at the highest possible speeds while automatically...

HPSBPI02656 SSRT090262 rev.2 - Certain HP Photosmart Printers, Remote Unauthorized Access, Cross Site Scripting (XSS)

Potential Security Impact Remote unauthorized access to data, cross site scripting XSS VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with certain HP Photosmart printers. These vulnerabilities could be exploited remotely for cross site scripting XSS or to gain...