DEBIAN-CVE-2018-12116

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to...

curl: FTP wildcard out of bounds read

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service out-of-bounds read and application crash or possibly have unspecified other impact via a string that ends with an '' character...

httpd: DoS for HTTP/2 connections by continuous SETTINGS frames

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

The vulnerability of the WLS component – the Web Services server of Oracle WebLogic Server – allows a attacker to disclose sensitive information that is protected by this system.

The vulnerability of the WLS component—the Web Services server of Oracle WebLogic Server—is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information using the HTTP network protocol...

D-LINK Central WifiManager CWM-100 FTP Server Port Bounce Scanning Vulnerability

D-LINK Central WifiManager CWM-100 is D-LINK centralized wireless management software. The FTP server component of D-LINK Central WifiManager can be used as a man-in-the-middle machine to allow PORT Command bounce scanning attacks. This vulnerability allows remote attackers to abuse the network a...

OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

CVE-2018-19076

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The FTP and RTSP services make it easier for attackers to conduct brute-force authentication...

Cisco Firepower Threat Defense Software Denial of Service Vulnerability

Cisco Firepower Threat Defense is a suite of software from the American company Cisco Cisco that runs in firewalls. A denial of service vulnerability exists in the FTP detection engine in version 6.2.3.x of Cisco Firepower Threat Defense FTD Software prior to 6.2.3.4. A remote attacker could...

Cisco RV180W Wireless-N Multifunction VPN Router WEB Framework Directory Traversal Vulnerability

The Cisco RV180W Wireless-N Multifunction VPN Router is a multifunction VPN router device. A directory traversal vulnerability exists in the Cisco RV180W Wireless-N Multifunction VPN Router WEB framework, which stems from the program failing to properly filter user-submitted input in HTTP request...

Cisco Prime Infrastructure Arbitrary File Upload Vulnerability

Cisco Prime Infrastructure PI is a set of Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technologies for wireless management. solution. An arbitrary file upload vulnerability exists in the HTTP web server of Cisco Prime Infrastructure PI versions 3.2 through...

BSA-2018-710

Security Advisory ID : BSA-2018-710 Component : Apache HTTPD Revision : 1.0: Final In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only...

DEBIAN-CVE-2018-11763

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

ALPINE-CVE-2018-11763

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

Synametrics SynaMan Information Disclosure Vulnerability

Synametrics SynaMan is a remote file manager from Synametrics Technologies, USA. An information disclosure vulnerability exists in Synametrics SynaMan version 4.0 build 1488, which stems from the program storing passwords for smtp email accounts in plaintext, which can be exploited by an attacker...

CVE-2018-8479

A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK...

CVE-2018-15502

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

CVE-2018-15485

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03...

The vulnerability of the built-in web server of Schneider Electric’s Modicon Premium, Modicon Quantum PLC, Modicon M340, and Modicon BMXNOR0200 allows a perpetrator to execute arbitrary code.

The vulnerability of Schneider Electric Modicon BMXNOR0200 embedded web servers is related to an error in HTTP request analysis. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the web server using specially crafted HTTP requests...

curl: FTP PWD response parser out of bounds read

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...

curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP

A heap-based buffer overflow has been found in the Curlsmtpescapeeob function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory...