CVE-2021-36187: Uncontrolled Resource Consumption

A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests...

FortiWLM - Command injection in script handlers

An improper neutralization of special elements used in an OS command vulnerability 'OS Command Injection' CWE-78 in FortiWLM may allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests to various controllers...

CVE-2021-32595: Uncontrolled Resource Consumption

Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests...

PT-2021-21168

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.0, 6.3.15 and below, 6.2.5 and below Description The issue is related to uncontrolled resource consumption, allowing an attacker to cause a denial of service for the webserver daemon via crafted HTTP requests...

PT-2021-21166

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.6.1 and below Description The issue is related to an improper neutralization of special elements used in an SQL command, also known as SQL Injection. This allows an attacker to disclose device, users, and database...

FortiWLM - SQL Injection in script handlers

An improper neutralization of special elements CWE-79 used in an SQL command vulnerability 'SQL Injection' CWE-89 in FortiWLM may allow an authenticated attacker to disclose sensitive information via crafted HTTP requests to various controllers...

PT-2021-21167

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.4.0, 6.3.15 and below, 6.2.5 and below Description A stack-based buffer overflow allows an attacker to execute unauthorized code or commands via crafted HTTP requests. Recommendations For FortiWeb version 6.4.0, update to a...

FortiWeb - Stack-Based Buffer Overflow vulnerability

A stack-based buffer overflow CWE-121 vulnerability in FortiWeb may allow an unauthenticated attacker to overwrite the content of the stack and potentially execute arbitrary code by sending crafted HTTP requests with large request parameter values...

FortiPortal - Denial of service vulnerabilities

Multiple uncontrolled resource consumption vulnerabilities CWE-400 in the web interface of FortiPortal may allow a single low-privileged user to induce a denial of service via multiple HTTP requests...

FortiWeb - Uncontrolled resource consumption

An uncontrolled resource consumption vulnerability CWE-400 in FortiWeb may allow an unauthenticated attacker to cause a denial of service via crafted HTTP requests to proxy services...

Denial of service

Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of ServiceDoS vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with labelselectors on multiple V3 endpoints by generating an enormous SQL query...

CVE-2021-22101

CVE-2021-22101 affects Cloud Foundry Cloud Controller prior to 1.118.0. It enables unauthenticated DoS by sending REST HTTP requests with label_selectors on multiple V3 endpoints, generating an enormous SQL query that can render the ccdb unavailable. Affected products include CAPI (pre-1.118.0) a...

PT-2021-4721

Name of the Vulnerable Software and Affected Versions Cisco Firepower Management Center FMC Software affected versions not specified Description The issue is related to multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software. These...

PT-2021-14852

Name of the Vulnerable Software and Affected Versions Cloud Controller versions prior to 1.118.0 Description The issue allows unauthenticated attackers to cause denial of service by using REST HTTP requests with label selectors on multiple V3 endpoints, generating an enormous SQL query. This can...

CVE-2021-22101: Uncontrolled Resource Consumption

Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of ServiceDoS vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with labelselectors on multiple V3 endpoints by generating an enormous SQL query...

GridPro Request Management For Windows Azure Pack 2.0.7905 Directory Traversal Vulnerability

GridPro Request Management for Windows Azure Pack versions 2.0.7905 and below suffer from a traversal vulnerability that can allow for arbitrary execution of Powershell scripts. PRODUCT : GridPro Request Management for Windows Azure Pack VENDOR : GridPro Software SEVERITY : Critical AFFECTED...

Cisco Integrated Management Controller GUI DoS (cisco-sa-imc-gui-dos-TZjrFyZh)

According to its self-reported version, Cisco Integrated Management Controller is affected by a denial of service DoS vulnerability in its web-based management interface due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can exploit this issue, by sending...

Server-Side Request Forgery (SSRF) in pimcore/pimcore

Description Your demo server is running in a vulnerable Apache server Apache/2.4.38. The attacker can easily exploit SSRF vulnerability just by visiting a crafted URL. The vulnerability has been discovered few days ago and it relies on modproxy module. I know that this vulnerability is not direct...

VPXD Service DoS

The vulnerability of the VPXD service Virtual Provisioning X Daemon, a management tool for VMware vCenter Server’s virtual infrastructure, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending a...

CVE-2021-34706 Cisco Identity Services Engine XML External Entity Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery SSRF attack through an affected device. This vulnerability is due to improper handling...