CVE-2024-33332

An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant...

novel-plus 安全漏洞

novel-plus 小说精品屋-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus version 4.3.0 and earlier, which stems from an arbitrary file read vulnerability that allows remote attackers to obtain sensitive information via a...

CVE-2024-33383

The CVE-2024-33383 case concerns novel-plus versions 4.3.0 and earlier, with an Arbitrary File Read via a crafted GET request that uses the filePath parameter to expose sensitive data. Affected component is the application’s filePath-handling path; root cause is improper validation/handling of fi...

CVE-2024-33332

An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant...

CVE-2024-33332

An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant...

CVE-2024-33332

The CVE-2024-33332 entry affects SpringBlade 3.7.1, where a crafted GET request to the endpoint api/blade-system/tenant can disclose sensitive information. The connected sources consistently describe an information disclosure in SpringBlade 3.7.1 without broader exploitation details. Impact is de...

PT-2024-25226 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: novel-plus versions 4.3.0 and earlier Description: The issue allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter. This enables the attacker to read arbitrary files, potentially leadi...

CVE-2023-31889

An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request...

CVE-2023-31889

An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request...

CVE-2023-31889

CVE-2023-31889 affects ASUS RT-AC51U with firmware versions up to 3.0.0.4.380.8591. The issue is an HTTPD service vulnerability allowing local attackers to cause a denial of service via a crafted GET request. Connected sources confirm the affected product and impact as described; there is no deta...

CVE-2023-31889

An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request...

ASUS RT-AC51U 安全漏洞

The ASUS RT-AC51U is a wireless router from Asus China. A security vulnerability exists in ASUS RT-AC51U 3.0.0.4.380.8591 and earlier versions, which originates from a vulnerability that allows a local attacker to cause a denial of service via a crafted GET request...

VulnCheck KEV: CVE-2024-28734

Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter...

CVE-2024-31551

Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request...

CVE-2024-31551

CVE-2024-31551 : A directory traversal in cmseasy v7.7.7.9 20240105 (lib/admin/image.admin.php) allows attackers to delete arbitrary files via a crafted GET request. Affected product: Cmseasy. CVSS v3.1 base score 7.5 (Network, Privileges: None, User interaction: None, Confidentiality: None, Inte...

CVE-2024-31551

Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request...

The vulnerability of the CGI script nas_sharing.cgi of the D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L NAS devices allows a hacker to execute arbitrary code.

The vulnerability of the CGI script nassharing.cgi of the D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L device operating systems is related to the use of pre-installed user accounts. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted...

PT-2024-7264 · 1с · Bitrix24 +1

Name of the Vulnerable Software and Affected Versions: 1C-Bitrix Bitrix24 version 23.300.100 Description: The issue is related to insufficiently protected credentials in the DAV server settings, allowing remote administrators to read proxy-server accounts passwords via an HTTP GET request. This...

flask-cors vulnerable to log injection when the log level is set to debug

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files,...

CVE-2024-1681 Log Injection Vulnerability in corydolphin/flask-cors

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files,...