CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

Contest Gallery < 19.1.5 - Unauthenticated SQL Injection

The plugins do not escape the cgFields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: localhost:8080...

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

The vulnerability of the sslgeneratecsr function in the web interface for managing WLAN client software Hirschmann BAT-C2 allows a hacker to execute arbitrary code.

The vulnerability of the sslgeneratecsr function in the web interface for managing WLAN client micro-programming systems from Hirschmann BAT-C2 is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending a specially crafte...

HTTP Request Smuggling

Varnish is vulnerable to HTTP request smuggling. The vulnerability exists in h2haddhdr function of cachehttp2hpack.c due to discrepancies in parsing HTTP requests which allows an attacker to smuggle HTTP requests...

Backdoor.Win32.Delf.gj MVID-2022-0663 Information Disclosure

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/8872c2ec49ff3382240762a029631684.txt Contact: [email protected] Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Backdoor.Win32.Delf.gj Vulnerability: Information...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to CVE-2022-35255 and CVE-2022-35256

Summary Node.js is used as a runtime engine by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands may be vulnerable to HTTP request smuggling and weaker than expected security. This bulletin provides patch...

Path Traversal

io.fusionauth:fusionauth-java-client is vulnerable to path traversal. An attacker is able to view or retrieve any file readable by the current user, via a maliciously crafted HTTP request, which allows the attacker to gain access to sensitive information in the system...

Lansweeper lansweeper TicketTemplateActions.aspx GetTemplateAttachment directory traversal vulnerability

Talos Vulnerability Report TALOS-2022-1531 Lansweeper lansweeper TicketTemplateActions.aspx GetTemplateAttachment directory traversal vulnerability December 1, 2022 CVE Number CVE-2022-27498 SUMMARY A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment...

Lansweeper lansweeper KnowledgebasePageActions.aspx ImportArticles directory traversal vulnerability

Talos Vulnerability Report TALOS-2022-1530 Lansweeper lansweeper KnowledgebasePageActions.aspx ImportArticles directory traversal vulnerability December 1, 2022 CVE Number CVE-2022-29511 SUMMARY A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles...

Lansweeper lansweeper AssetActions.aspx directory traversal vulnerability

Talos Vulnerability Report TALOS-2022-1528 Lansweeper lansweeper AssetActions.aspx directory traversal vulnerability December 1, 2022 CVE Number CVE-2022-32573 SUMMARY A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A...

The vulnerability of the SetDdns-domain component in the Reolink RLC-410W camera’s microprogramming system allows a intruder to execute arbitrary commands.

The vulnerability of the SetDdns-domaind component in the Reolink RLC-410W video camera software exists because measures to neutralize the special elements used in the operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...

Security Bulletin: Multiple vulnerabilities in Netty libraries affect IBM Operations Analytics Predictive Insights (CVE-2021-43797 CVE-2022-24823)

Summary Netty library vulnerabilities affect IBM Operations Analytics Predictive Insights CVE-2021-43797 CVE-2022-24823. Netty is used by IBM Operations Analytics Predictive Insight in the REST Mediation utility. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2021-43797...

Oracle Linux 9 : varnish (ELSA-2022-8643)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8643 advisory. 6.6.2-2.1 - Resolves: 2142095 - CVE-2022-45060 varnish: Request Forgery Vulnerability Tenable has extracted the preceding description block directly from the...

Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 35 / 9.0.0 < 9.0.0 Patch 28 Multiple Vulnerabilities

According to its self-reported version number, Zimbra Collaboration Server is affected by a multiple vulnerabilities, as follows: - A vulnerability in the ClamAV package: On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and...

GHSA-RMCX-FG5W-X8J9 FusionAuth vulnerable to directory traversal attack

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...

Design/Logic Flaw

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...