5945 matches found
MGASA-2022-0369 Updated lighttpd packages fix security vulnerability
In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. CVE-2022-37797 A...
ROS-20221007-02
Vulnerability of lighttpd web server is related to memory leak in modfastcgi and modscgi modules while processing a large number of incorrect HTTP requests. a large number of malformed HTTP requests. Exploiting the vulnerability could allow an attacker, acting remotely, send multiple invalid HTTP...
ROS-20221004-02
Vulnerability of lighttpd web server is related to a null pointer dereferencing error in modwstunnel module module when processing invalid HTTP requests. Exploitation of the vulnerability could allow an attacker, remotely, send specially crafted HTTP requests to a vulnerable web server and execut...
Lighttpd < 1.4.67 DoS Vulnerability
Lighttpd is prone to a denial of service DoS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
Security Bulletin: IBM Tivoli Monitoring Basic Services Vulnerabilities (CVE-2013-2960, CVE-2013-2961 , CVE-2013-0548, CVE-2013-0551)
Abstract Several vulnerabilites have been resolved in the Basic Services component of IBM Tivoli Monitoring. These vulnerabilies could have potentially caused a denial of service or Cross Site Scripting XSS exposure.. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-2960 DESCRIPTION: The HTTP...
Information Disclosure
spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests...
Exploit for OS Command Injection in Netgate Pfblockerng
SenselessViolence CVE-2022-31814 pfSense pfBlockerNG = 2.1.4...
CVE-2022-39158
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969...
CVE-2022-39158
CVE-2022-39158 affects Siemens RuggedCom ROS/ROS-based devices (e.g., i800, i801, i802, i803, RMC8388, RP110, RS1600/RS400 variants, RSG family, RSL/RST series, etc.). Root cause: improper handling of partial HTTP requests, enabling a slowloris-style denial of service that can persist until the a...
PT-2022-23194 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.16 Description: The issue arises when requesting invalid or non-existing resources via HTTP, triggering the page error handler to retrieve content from another page, leading to recursive application calls that...
CVE-2022-39158
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969...
Path traversal
Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests...
CVE-2022-29062
CVE-2022-29062 affects Fortinet FortiSOAR before 7.2.1. The vulnerability is a set of relative path traversal flaws in the FortiSOAR web API that allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests. Impact is described as the abi...
CVE-2022-29062
Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests...
Fortinet FortiWeb OS command injection due to direct input interpolation in API controllers (FG-IR-21-180)
The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-180 advisory. - A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 6.4....
FortiSOAR - Path traversal vulnerabilities in the web API
Multiple relative path traversal vulnerabilities CWE-23 in the web API of FortiSOAR may allow an authenticated attacker to write in the underlying filesystem with nginx permissions via crafted HTTP requests...
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W allows a perpetrator to execute arbitrary commands or cause service failures.
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W arises from the copying of buffers without checking the size of the input data during the processing of user fields in incoming HTTP packets. Exploiting...
Quarkus does not terminate HTTP requests header context
Quarkus is a Cloud Native, Linux Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final...