CVE-2021-33841

SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges...

PT-2021-20343 · Unknown · Sge-Plc1000

Name of the Vulnerable Software and Affected Versions: SGE-PLC1000 device version 0.9.2b Description: The issue allows a remote attacker to inject code into the operating system with maximum privileges due to incorrect handling of certain requests. Recommendations: For version 0.9.2b, at the...

Building an A/B Test with EdgeWorkers and EdgeKV

This blog was co-authored by Tim Vereecke, Josh Johnson, and Medhat Yakan This is a blog series about building an A/B test with EdgeWorkers and EdgeKV. Read part two here. When paired with our new EdgeKV distributed key-value database, the Akamai EdgeWorkers serverless platform gives you the...

BSA-2021-1490

Security Advisory ID : BSA-2021-1490 Component : Web Management Interface Revision : 1.1 The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properly handle malformed user input, resulting in a service crash. An...

The vulnerability of the WSGI Micro-Framework configuration, Bottle, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the WSGI Micro-Framework “Bottle” is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Hotel And Lodge Management System 1.0 Shell Upload

Exploit Title: Hotel and Lodge Management System 1.0 - Remote Code Execution Unauthenticated Date: 07-03-2021 Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html...

CVE-2020-27223

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

Design/Logic Flaw

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

CVE-2020-27223

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

The vulnerability in the web interface for managing microprogramming software on Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W routers allows a perpetrator to execute arbitrary code.

The vulnerability of the web-based management interfaces for Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN routers is related to errors in handling HTTP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability in the web interface for managing microprogramming software on Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W routers allows a perpetrator to execute arbitrary code.

The vulnerability of the web-based management interfaces for Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W microprogramming systems lies in HTTP request processing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2021-22293

Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vulnerability to cause information leak. Affected product versions include: CampusInsight versions V100R019C10; ManageOne versions 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1,...

ERPNext 12.14.0 - SQL Injection (Authenticated)

Exploit Title: ERPNext 12.14.0 - SQL Injection Authenticated Date: 21-01-21 Exploit Author: Hodorsec Vendor Homepage: http://erpnext.org Software Link: https://erpnext.org/download Version: 12.14.0 Tested on: Ubuntu 18.04 !/usr/bin/python3 AUTHENTICATED SQL INJECTION VULNERABILITY In short: Found...

squid: Improper input validation in URI processor

An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers,...

CVE-2020-1243

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a...

CVE-2020-2288

In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling...

The vulnerability of the Apache Tomcat application server, related to the inconsistent interpretation of HTTP requests, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Apache Tomcat application server is related to the inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of the protected information...

The vulnerability of the Windows operating system’s DNS server, related to errors in handling DNS requests, allows a hacker to cause a service failure.

The vulnerability of the Windows operating system’s DNS server is related to errors in handling DNS requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted DNS request...

The vulnerability of the ngx_http_lua_subrequest.c component in the OpenResty web server allows a attacker to compromise data integrity.

The vulnerability of the ngxhttpluasubrequest.c component in the OpenResty web server is related to inconsistent interpretation of http requests. Exploiting this vulnerability could allow a malicious actor to compromise data integrity from a remote location...

undertow: invalid HTTP request with large chunk size

A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...