sthttpd Denial of Service Vulnerability

sthttpd is an improved version of thttpd, a small, simple, fast and secure HTTP server implementation that supports HTTP/1.1. A denial of service vulnerability exists in sthttpd version 2.27.1 and earlier. The vulnerability is related to a memory error in the handling of the dedotdot function in...

CVE-2021-26843

An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the dedotdot function may cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted...

CVE-2021-26843

An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the dedotdot function may cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted...

CVE-2021-26843

An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the dedotdot function may cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted...

CVE-2021-26843: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the dedotdot function may cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted...

PT-2021-17159

Name of the Vulnerable Software and Affected Versions: sthttpd versions prior to 2.27.1 Description: An issue in the de dotdot function can cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy when the strcpy function is implemented with memcpy. This can ...

PT-2021-9674

Name of the Vulnerable Software and Affected Versions Mofi Network MOFI4500-4GXeLTE versions 3.6.1-std through 4.0.8-std Description An issue was discovered where Mofi Network MOFI4500-4GXeLTE devices can be rebooted by sending an unauthenticated HTTP GET request to the "poof.cgi" endpoint...

CVE-2020-13857: Undefined Security Weakness

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They can be rebooted by sending an unauthenticated poof.cgi HTTP GET request...

CVE-2019-25014

A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic resulting in a denial of service to the istio-pilot...

CVE-2020-36200

TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs...

CVE-2019-25014

An out-of-bounds read flaw was found in istio-pilot. This flaw allows an attacker to send a crafted HTTP GET request to the pilot debug API endpoint. This action causes pilot to panic, resulting in a denial of service to the istio pilot application. The highest threat from this vulnerability is t...

ERPNext 12.14.0 SQL Injection

Exploit Title: ERPNext 12.14.0 - SQL Injection Authenticated Date: 21-01-21 Exploit Author: Hodorsec Vendor Homepage: http://erpnext.org Software Link: https://erpnext.org/download Version: 12.14.0 Tested on: Ubuntu 18.04 !/usr/bin/python3 AUTHENTICATED SQL INJECTION VULNERABILITY In short: Found...

Selea Targa IP OCR-ANPR Camera Remote Code Execution

!/bin/bash Selea Targa IP OCR-ANPR Camera Unauthenticated Remote Code Execution Vendor: Selea s.r.l. Product web page: https://www.selea.com Affected version: Model: iZero Targa 512 Targa 504 Targa Semplice Targa 704 TKM Targa 805 Targa 710 INOX Targa 750 Targa 704 ILB Firmware: BLD201113005214...

CVE-2020-36200

TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs...

CVE-2020-36200: Server-Side Request Forgery (SSRF)

TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs...

PT-2021-11966

Name of the Vulnerable Software and Affected Versions: TinyCheck versions before 9fd360d and ea53de8 Description: The issue allows an authenticated attacker to send an HTTP GET request to crafted URLs. Recommendations: For versions before 9fd360d and ea53de8, update to a version that includes...

Backdoor.Win32.Zombam.geq Remote Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/fd14cc7f025f49a3e08b4169d44a774e.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.geq Vulnerability: Remote Buffer Overflow Description: Zombam.geq listens for...

Backdoor.Win32.Ketch.b Remote Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com c 2021 Original source: https://malvuln.com/advisory/9d7be3799594a82bf7056905f501af03.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Ketch.b Vulnerability: Remote Stack Buffer Overflow Description: Makes HTTP GET reque...

IBM Emptoris Strategic Supply Management Platform Information Disclosure Vulnerability

The IBM Emptoris Strategic Supply Management Platform is the public portal to the Emptoris suite of products. An information disclosure vulnerability exists in IBM Emptoris Strategic Supply Management Platform 10.1.0, 10.1.1, and 10.1.3. The vulnerability stems from the product transmitting...

CVE-2020-4893

IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure via man in the middle methods. IBM X-Force ID: 190984...