3257 matches found
varnish: Request Forgery Vulnerability
An HTTP Request Forgery issue was discovered in Varnish Cache. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit...
MOXA SDS-3008 安全漏洞
Moxa SDS-3008 is a series of industrial switches from MOXA China. The Moxa SDS-3008 suffers from an information disclosure vulnerability that can be exploited by an attacker to send specially crafted HTTP requests resulting in the disclosure of sensitive information...
PT-2023-18848 · Connectwise · Connectwise Control
Name of the Vulnerable Software and Affected Versions: Connectwise Control version 22.8.10013.8329 Description: The login page of Connectwise Control does not implement HSTS headers, which results in not enforcing HTTPS. The vendor's position is that this behavior is controlled by a configuration...
Socomec MODULYS GP 安全漏洞
Socomec MODULYS GP is a green power device from Socomec, a French company. A security vulnerability exists in Socomec MODULYS GP version 7.20 and prior versions, which stems from its lack of strong encryption of credentials on HTTP connections that could allow threat actors to obtain sensitive...
golang: net/http: handle server errors after sending GOAWAY
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...
CVE-2023-21850
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain component: E-Business Collections. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
Oracle E-Business Suite 安全漏洞
Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business...
golang: net/http: handle server errors after sending GOAWAY
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...
Zyxel AX7501-B0 后置链接漏洞
The Zyxel AX7501-B0 is a router from China Heqin Zyxel. A security vulnerability exists in Zyxel AX7501-B0 versions prior to V5.17ABPC.3C0. An attacker could exploit the vulnerability to access the root filesystem by creating a symbolic link on an external storage medium e.g., a USB flash drive a...
PT-2023-15973 · Sauter · Sauter Controls Nova 200–220 Series
Name of the Vulnerable Software and Affected Versions: SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior BACnetstac versions 4.2.1 and prior Description: The issue affects device management, where sensitive information such as credentials is sent in cleartext through FTP and Telnet...
Sauter AG Controls Nova 安全漏洞
Sauter AG Controls Nova is an intelligent building automation system from Sauter AG, Switzerland. A security vulnerability exists in Sauter AG Controls Nova 200-220 Series firmware version 3.3-006 and earlier and BACnetstac version 4.2.1 and earlier, which stems from the fact that only FTP and...
The vulnerability of the Web Server software on Schneider Electric’s programmable logic controllers, such as Modicon M340, Modicon Quantum, and Modicon Premium, allows attackers to disclose sensitive information or cause malfunctions in the equipment.
The vulnerability of the Web Server component of Schneider Electric’s programmable logic controllers—Modicon M340, Modicon Quantum, and Modicon Premium—is due to buffer overflow attacks. Exploiting this vulnerability allows an attacker to disclose sensitive information or cause service failures b...
CVE-2022-39187
Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting RXSS vulnerability through unspecified vectors...
Cisco BroadWorks Application 输入验证错误漏洞
Cisco BroadWorks Application is an enterprise-class calling and collaboration platform from Cisco USA. A security vulnerability exists in the Cisco BroadWorks Application Delivery Platform that stems from improper input validation when parsing HTTP, which can lead to a denial of service...
CVE-2017-16287
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker...
FTP 安全漏洞
FTP is a simple FTP client and server implementation by Rovin Bhandari, a personal developer. A security vulnerability in FTP version 96c1a35, which stems from the use of malloc instead of free, can be exploited by an attacker to cause a denial of service by engaging in client-side activity such ...
The vulnerability of the Moodle course management system lies in the insufficient verification of the HTTP source in the URL address of the course redirect. This allows attackers to execute attacks by manipulating inter-site requests.
The vulnerability of the Moodle course management system is related to insufficient verification of the HTTP source in the URL address of the course redirect. Exploiting this vulnerability allows a malicious actor to carry out attacks by manipulating inter-site requests...
CVE-2022-47895
In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files...
SolarWinds Serv-U FTP Server 授权问题漏洞
SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the U.S. company SolarWinds. SolarWinds Serv-U FTP Server suffers from an authorization issue vulnerability that stems from the deployment of a common encryption key across all of its instances resulting in an...
