CVE-2024-48956: Use of Default Cryptographic Key

Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint resulting in remote code execution...

CVE-2024-48956

CVE-2024-48956 affects Serviceware Processes versions 6.0 through 7.3 prior to 7.4. The issue enables unauthenticated attackers to send a specially crafted HTTP request to a service endpoint, leading to remote code execution. Public sources in the provided documents consistently describe this as ...

Waitress HTTP Request Smuggling

The vulnerability of the channelrequestlookahead function in the WSGI server for Python Waitress is related to synchronization errors when using shared resources due to inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a remote attacker to send hidden HTTP request...

CVE-2024-52558

The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program...

CVE-2024-52320

The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution...

CVE-2024-52558 Planet Technology Planet WGS-804HPT Integer Underflow

The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program...

CVE-2024-52320

Planet Technology WGS-804HPT series switches are affected by CVE-2024-52320, a pre-authentication command injection flaw that can lead to remote code execution via a crafted HTTP request. The issue is documented with high criticality (CVSS v3.1/4.0 scores: 9.8/9.3, network access, no authenticati...

CVE-2024-48871 Planet Technology Planet WGS-804HPT Stack-based Buffer Overflow

The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution...

CVE-2024-48871

CVE-2024-48871 affects Planet Technology’s Planet WGS-804HPT industrial switch. The issue is a stack-based buffer overflow exposed via a crafted HTTP request, allowing unauthenticated remote code execution. Public mentions in THN’s coverage confirm this CVE as part of a set of flaws in the dispat...

CVE-2024-30129 HCL Nomad server on Domino is affected by a host header injection vulnerability

The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address...

CVE-2024-42196

HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs...

CVE-2024-48871: Stack-based Buffer Overflow

The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution...

CVE-2024-52320: Improper Neutralization of Special Elements used in an OS Command

The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution...

CVE-2024-42196: Insertion of Sensitive Information into Log File

HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs...

CVE-2024-52558: Integer Underflow (Wrap or Wraparound)

The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program...

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

BIT-HAPROXY-2024-53008

Inconsistent interpretation of HTTP requests 'HTTP Request/Response Smuggling' issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL Access Control List set on the product. As a result, the attacker may obtain sensitive...

IBM Jazz Foundation Access Control Error Vulnerability

IBM Jazz Foundation is a next-generation collaboration platform for software delivery technology from International Business Machines IBM. An Access Control Error vulnerability exists in IBM Jazz Foundation versions 7.0.2 and 7.0.3 that stems from improper access control and can be exploited by a...

CVE-2024-45206: Server-Side Request Forgery (SSRF)

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...