7022 matches found
Security Bulletin: IBM Tivoli Monitoring Basic Services Vulnerabilities (CVE-2013-2960, CVE-2013-2961 , CVE-2013-0548, CVE-2013-0551)
Abstract Several vulnerabilites have been resolved in the Basic Services component of IBM Tivoli Monitoring. These vulnerabilies could have potentially caused a denial of service or Cross Site Scripting XSS exposure.. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-2960 DESCRIPTION: The HTTP...
Information Disclosure
spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests...
Exploit for OS Command Injection in Netgate Pfblockerng
SenselessViolence CVE-2022-31814 pfSense pfBlockerNG = 2.1.4...
CVE-2022-39158
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969...
CVE-2022-39158
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969...
CVE-2022-39158
CVE-2022-39158 affects Siemens RuggedCom ROS/ROS-based devices (e.g., i800, i801, i802, i803, RMC8388, RP110, RS1600/RS400 variants, RSG family, RSL/RST series, etc.). Root cause: improper handling of partial HTTP requests, enabling a slowloris-style denial of service that can persist until the a...
PT-2022-23194 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.16 Description: The issue arises when requesting invalid or non-existing resources via HTTP, triggering the page error handler to retrieve content from another page, leading to recursive application calls that...
WS-2022-0460
Monero daemon monerod does not limit Content-length variable when processing incoming HTTP requests. An attacker can force monerod to allocate arbitrary amount of memory. Version 0.17.3.2 contains sanity check to RPC input data size...
Path traversal
Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests...
CVE-2022-29062
CVE-2022-29062 affects Fortinet FortiSOAR before 7.2.1. The vulnerability is a set of relative path traversal flaws in the FortiSOAR web API that allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests. Impact is described as the abi...
CVE-2022-29062
Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests...
Fortinet FortiWeb OS command injection due to direct input interpolation in API controllers (FG-IR-21-180)
The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-180 advisory. - A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 6.4....
FortiSOAR - Path traversal vulnerabilities in the web API
Multiple relative path traversal vulnerabilities CWE-23 in the web API of FortiSOAR may allow an authenticated attacker to write in the underlying filesystem with nginx permissions via crafted HTTP requests...
Cisco Small Business RV110W Router Arbitrary Command Execution
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W arises from the copying of buffers without checking the size of the input data during the processing of user fields in incoming HTTP packets. Exploiting...
Quarkus does not terminate HTTP requests header context
Quarkus is a Cloud Native, Linux Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final...
Design/Logic Flaw
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior...
EUVD-2022-6884
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior...
CVE-2022-2466
Summary: CVE-2022-2466 affects Quarkus 2.10.x due to incomplete termination of the HTTP request header context, enabling HTTP request smuggling as described in connected sources. The issue relates to the handle logic in SmallRyeGraphQLAbstractHandler.java and may cause unpredictable behavior. The...