CVE-2024-53582

An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request...

CVE-2025-24501

An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request...

CVE-2025-24501

An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request...

Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in multiple Open-Source Software (OSS) components

Summary There are vulnerabilities in multiple Open-Source Software OSS components consumed by IBM Planning Analytics Workspace. These issues have been addressed in IBM Planning Analytics Workspace by upgrading or removing the vulnerable libraries. Please refer to the table in the Related...

BIT-RUBY-MIN-2020-25613

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

Elspec G5 Digital Fault Recorder Inconsistent Interpretation of HTTP Requests (CVE-2024-22081)

An issue was discovered in Elspec G5 digital fault recorder. Unauthenticated memory corruption can occur in the HTTP header parsing mechanism. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2022-23439: Externally Controlled Reference to a Resource in Another Sphere

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the Host header points to an arbitrary webserver...

@apt-repositories/generator (>=1.0.1-dev.120, <=1.0.2-dev.39), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.4) +57 more potentially affected by CVE-2025-22150 via undici (>=7.0.0, <=7.2.2)

undici NPM version =7.0.0, =1.0.1-dev.120, =1.6.3, =24.0.0, =12.0.0, =3.0.0, =0.92.0-alpha-20241217175715-33d88539e49f1b72d6dd1c7e5f8d3a0c16e8dcb9, =2.19.0-alpha.4, =2.19.0-alpha.4, =2.19.0-alpha.4, =2.19.0-alpha.4, =2.19.0-alpha.4, =2.19.0-alpha.4, =2.38.0 and more Source cves: CVE-2025-22150...

CVE-2024-57036

TOTOLINK A810R V4.1.2cu.5032B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an attacker to execute arbitrary commands by sending HTTP request...

CVE-2024-57036

The TOTOLINK A810R wireless dual-band router (specifically firmware V4.1.2cu.5032_B20200407 ) contains a command injection vulnerability in the downloadFile.cgi main function. The root cause is a lack of sufficient measures to neutralize special elements used in operating system commands. A remot...

PT-2025-2727

Name of the Vulnerable Software and Affected Versions: Payara Server versions 4.1.151 through 4.1.2.191.51 Payara Server versions 5.20.0 through 5.70.0 Payara Server versions 5.2020.2 through 5.2022.5 Payara Server versions 6.2022.1 through 6.2024.12 Payara Server versions 6.0.0 through 6.21.0...

PT-2025-4248

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions prior to 9.2.9.0 Description The issue is related to the lack of authentication for a critical function in the Monitoring and Diagnostics SEC component. This easily exploitable vulnerability allows an...

CVE-2024-57036

TOTOLINK A810R V4.1.2cu.5032B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an attacker to execute arbitrary commands by sending HTTP request...

CVE-2024-45687: Improper Neutralization of CRLF Sequences in HTTP Headers

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in Payara Platform Payara Server Grizzly, REST Management Interface modules, Payara Platform Payara Micro Grizzly modules allows Manipulating State, Identity Spoofing.This issue affects Payar...

CVE-2024-45091: Insertion of Sensitive Information into Log File

IBM UrbanCode Deploy UCD 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs...

CVE-2024-57036

TOTOLINK A810R V4.1.2cu.5032B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an attacker to execute arbitrary commands by sending HTTP request...

PT-2025-4244

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions prior to 9.2.9.0 Description The issue is related to a lack of authentication for a critical function in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools. This can be exploited by a remote...

CVE-2024-57036: Improper Neutralization of Special Elements used in a Command

TOTOLINK A810R V4.1.2cu.5032B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an attacker to execute arbitrary commands by sending HTTP request...

CVE-2025-23039 Cross Site Scripting on URL decode Tooltip in Caido

Caido is a web security auditing toolkit. A Cross-Site Scripting XSS vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to...

CVE-2025-0528 Tenda AC8/AC10/AC18 HTTP Request telnet command injection

A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched...