219 matches found
CVE-2019-13969
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...
CVE-2019-10657
Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config request...
The vulnerability of Secutech router microprogramming software, related to insufficient verification of data authenticity, allows a hacker to alter DNS settings.
The vulnerability of Secutech router microprogramming software is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor to alter DNS settings by making a request to goform/AdvSetDns?GO=wandns.asp...
CVE-2019-9040
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
MGASA-2019-0035 Updated python-django packages fix security vulnerability
An upstream patch has been backported to fix a security vulnerability in python-django. CVE-2019-3498: Content spoofing possibility in the default 404 page An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the...
PT-2018-2973
Name of the Vulnerable Software and Affected Versions Node.js versions prior to 6.15.0 Node.js versions prior to 8.14.0 Description The issue is related to HTTP request splitting, where Node.js can be tricked into using unsanitized user-provided Unicode data for the path option of an HTTP request...
fsk-server Directory Traversal Vulnerability
Node.js module fsk-server is a simple http server. A directory traversal vulnerability exists in fsk-server. An attacker can exploit this vulnerability by placing ". /" in a url to access the file system...
UBUNTU-CVE-2017-12196
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the...
ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability
ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...
Parameter overflow vulnerability in OpenResty uri
OpenResty® is a high-performance web platform based on Nginx and Lua, with a large number of well-integrated Lua libraries, third-party modules, and most dependencies. A parameter overflow vulnerability exists in OpenResty uri. The vulnerability stems from the program's inability to properly fetc...
CVE-2017-9790
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore...
Arbitrary File Download Vulnerability in javaee Forum System
javaee forum system is a free open source javaee forum source code system , using springMVC mybatis framework development. javaee forum system has an arbitrary file download vulnerability , an attacker can forge files through the path in the request to download the site configuration or system...
CVE-2016-9564
Buffer overflow in sendredirect in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with only '/' and '.' characters...
Imperial Fairytale - Multiple Script Direct Request Path Disclosure
The imperial-fairytale WordPress theme was affected by a Multiple Script Direct Request Path Disclosure security vulnerability...
Q and A - Multiple Scripts Direct Request Path Disclosure
The q-and-a WordPress plugin was affected by a Multiple Scripts Direct Request Path Disclosure security vulnerability...
Атаки через Request-Path + Баги IE
На эту тему скоро будет статейка на пару страниц прим. Хакер, апрель 2013. Идея ужасно банальная, но результат тестирования очень удивил + обнаружены интересные баги. Зачастую при тестировании забывают, что небезопасно могут обрабатываться не только Get/Post/Cookie параметры, но и Request-URI /...
UBUNTU-CVE-2012-2922
The requestpath function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q parameter to index.php, which reveals the installation path in an error message...
CVE-2006-2186
zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the 1 /photos/themes/default/ and 2 /photos/themes/testing/ URIs, which reveals the path in an error message...
