3553 matches found
CVE-2017-12615
CVE-2017-12615 affects Apache Tomcat 7.0.0–7.0.79 on Windows when HTTP PUTs are enabled (readonly=false), allowing an attacker to upload a JSP file that can be executed by the server. Connected documents confirm remote code execution via crafted requests and note remediation through vendor adviso...
CVE-2017-12615
Removed by vendor...
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it containe...
Apache Tomcat 7.0.0 < 7.0.81 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 7.0.81. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat7.0.81security-7 advisory. - When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security...
Mako Server SSRF / Disclosure / Code Execution
SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3391 + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAKO-WEB-SERVER-MULTIPLE-UNAUTHENTICATED-VULNERABILIITIES-SECURITEAM.txt + ISR: ApparitionSec...
Default credentials
On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...
CVE-2017-14335
On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...
CVE-2017-14335
On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...
Hanbanggaoke IP Camera Arbitrary Password Change
Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of...
PT-2017-13398
Name of the Vulnerable Software and Affected Versions Hanbang Hanbanggaoke devices affected versions not specified Description The issue arises from insufficient sanitization of user-controlled input. By sending a PUT request to the "/ISAPI/Security/users/1" API endpoint, it is possible to change...
CVE-2017-14335: Improper Input Validation
On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...
Hanbanggaoke IP Camera - Arbitrary Password Change
Hanbanggaoke IP Camera - Arbitrary Password Change Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been...
PT-2017-3182
Name of the Vulnerable Software and Affected Versions Quagga versions prior to 1.2.2 Description The issue is related to the aspath put function in bgpd/bgp aspath.c, which allows remote attackers to cause a denial of service session drop via BGP UPDATE messages. This is due to incorrect AS PATH...
Mako Server v2.5, 2.6 OS Command Injection RCE
This module exploits a vulnerability found in Mako Server v2.5, 2.6. It's possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to manage.lsp...
PT-2017-12601
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.79 Description The issue allows an attacker to upload a JSP file to the server via a specially crafted request when HTTP PUTs are enabled, for example, by setting the readonly initialisation parameter o...
[SECURITY] Fedora 25 Update: curl-7.51.0-9.fc25
curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...
DEBIAN-CVE-2017-11114
The putchars function in htmlr.c in Twibright Links 2.14 allows remote attackers to cause a denial of service buffer over-read via a crafted HTML file...
PT-2017-11750
Name of the Vulnerable Software and Affected Versions Twibright Links version 2.14 Description The issue allows remote attackers to cause a denial of service, specifically a buffer over-read, by using a crafted HTML file. This is due to a problem in the put chars function located in the html r.c...