CVE-2019-13955

Mikrotik RouterOS before 6.44.5 long-term release tree is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected...

Node.js third-party modules: [script-manager] Unintended require

I would like to report Unintended Require in script-manager. It allows loading arbitary non-production code js files. Module module name: script-manager version: 0.8.6 npm page: https://www.npmjs.com/package/script-manager Module Description node.js manager for running foreign and potentially...

CVE-2019-13955: Uncontrolled Recursion

Mikrotik RouterOS before 6.44.5 long-term release tree is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected...

CVE-2019-13954: Allocation of Resources Without Limits or Throttling

Mikrotik RouterOS before 6.44.5 long-term release tree is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system. Malicious code cannot be injected...

Cross-site Scripting (XSS)

min-http-server is vulnerable to cross-site scripting XSS. The attack is due to lack of sanitization of filenames before rendering as HTML in listing directory page...

PT-2019-3741

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.44.5 Description The issue is related to memory exhaustion, where an authenticated remote attacker can crash the HTTP server and potentially reboot the system by sending a crafted HTTP request. This can le...

CVE-2019-2751

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware subcomponent: OHS Config MBeans. Supported versions that are affected are 12.1.3.0.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2019-2751

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware subcomponent: OHS Config MBeans. Supported versions that are affected are 12.1.3.0.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2019-2751

CVE-2019-2751 affects Oracle Fusion Middleware Oracle HTTP Server (OHS Config MBeans) with affected versions 12.1.3.0.0 and 12.2.1.3.0. The vulnerability allows an unauthenticated attacker with network access via HTTPS to read/modify data, enabling unauthorized access to Oracle HTTP Server data. ...

Security Bulletin: Rational Build Forge Security Advisory for Apache HTTP Server (CVE-2019-0196;CVE-2019-0197;CVE-2019-0211;CVE-2019-0215;CVE-2019-0217; and CVE-2019-0220)

Summary Apache HTTP Server has security vulnerabilities that allows a remote attacker to exploit the application. Respective security vulnerabilities are discussed in detail in the subsequent sections. Vulnerability Details This section includes the vulnerability details that affects the Rational...

CVE-2019-2751: Undefined Security Weakness

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware subcomponent: OHS Config MBeans. Supported versions that are affected are 12.1.3.0.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

PT-2019-16468

Name of the Vulnerable Software and Affected Versions Oracle HTTP Server versions 12.1.3.0.0 and 12.2.1.3.0 Description The issue allows an unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server, resulting in unauthorized access to critical data or complete access...

PT-2019-3164

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS versions prior to 6.44.5 Description The issue is related to uncontrolled resource consumption, which can be exploited by sending a crafted HTTP request, allowing an authenticated remote attacker to crash the HTTP server via...

gym-http-server (0.0.1), komand (3.2.0) +1 more potentially affected by CVE-2019-1010083 via flask (0.12.3)

flask PYPI version 0.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - gym-http-server 0.0.1 - komand 3.2.0 - shrunk 0.6.1 Source cves: CVE-2019-1010083 Source advisory: OSV:GHSA-5WV5-4VPF-PJ6M...

CVE-2019-13980

In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads//originals remote code execution with nginx...

Remote code execution

In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads//originals remote code execution with nginx...

CVE-2019-13980

Directus 7 API (up to version 2.3.0) permits PHP uploads only when using Apache; with nginx, uploads/_/originals can lead to remote code execution. No exploitation details are provided in the given documents beyond this risk description. Remediation/patch details are not included in the connected...

Oracle Fusion Middleware Oracle HTTP Server (Jul 2019 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by the following vulnerabilities as noted in the July 2019 CPU advisory : - A privilege escalation vulnerability exists in the web listener component. An authenticated, local attacker can exploit this, to gain privileged...

Apache HTTP Server mod_http2 Information Disclosure

The vulnerability of the modhttp2 module in the Apache HTTP Server is related to the use of memory after deallocation. Exploiting this vulnerability can allow a malicious actor to cause service failures or gain access to confidential information by sending specially crafted requests...

gym-http-server (0.0.1), komand (3.2.0) +1 more potentially affected by CVE-2018-1000656 +1 more via flask (0.12.3)

flask PYPI version 0.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - gym-http-server 0.0.1 - komand 3.2.0 - shrunk 0.6.1 Source cves: CVE-2018-1000656, CVE-2019-1010083 Source advisory: OSV:PYSEC-2019-179...