PT-2023-1320 · Netcomm · Netcomm Nf20Mesh +2

Name of the Vulnerable Software and Affected Versions: Netcomm NF20 versions Netcomm NF20MESH versions Netcomm NL1902 versions Description: The issue is related to an authentication bypass in the Netcomm router models. This allows an unauthenticated user to access content. The application checks...

CVE-2022-4874

Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL .css, .png etc. If it exists, it performs a “fake logi...

CVE-2022-23506 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

CVE-2022-4735

A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch i...

dash-live 跨站脚本漏洞

dash-live is a library by Alex Ashley, a personal developer. Fake DASH Live profile endpoints using static assets. A cross-site scripting vulnerability exists in dash-live, which stems from a ready function in the static/js/media.js file of its DOM Node Handler component that allows an attacker t...

CVE-2021-4272

A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is...

Cross site scripting

A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is...

Directory Traversal

easy-static-server is vulnerable to directory traversal. The vulnerability exists in the easyServer function of index.js due to missing input sanitization which allows an attacker to access files and directories that are stored outside the intended folder via req.url...

CVE-2022-25931 Directory Traversal

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code...

CVE-2022-25931

CVE-2022-25931 affects all versions of the npm package easy-static-server. The root cause is missing input sanitization and the use of sandboxes around req.url in the easyServer function (index.js), enabling a Directory Traversal attack to access files/directories outside the intended folder. Doc...

CVE-2022-46545

Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting...

CVE-2022-46546

Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/RouteStatic...

easy-static-server vulnerable to Directory Traversal

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code...

GHSA-WCWM-C3MR-PXCR easy-static-server vulnerable to Directory Traversal

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code...

CVE-2022-25931

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code...

easy-static-server 路径遍历漏洞

npm easy-static-server is a simple static file server from the US company npm. A security vulnerability exists in easy-static-server, which stems from a lack of input cleanup and vulnerability to directory traversal attacks...

GHSA-3W37-5P3P-JV92 Apache CXF vulnerable to Exposure of Sensitive Information

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes...

CVE-2022-46363 Apache CXF directory listing / code exfiltration

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes...

PT-2022-27839 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.4.10 Apache CXF versions prior to 3.5.5 Description: A vulnerability in Apache CXF allows an attacker to perform a remote directory listing or code exfiltration. This issue arises when the CXFServlet is configur...

CVE-2022-2641

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition...