GHSA-RVGG-F8QM-6H7J High severity vulnerability that affects io.vertx:vertx-web

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet...

Denial Of Service (DoS)

vertx-core is vulnerable to a denial of service DoS attack. The websocket implementation does not properly handle HTTP requests properly, buffering the entire request body into memory before the handshake. This can allow a malicious user to pass a large HTTP request to the application to cause it...

vertx-web: Incomplete CSRF validation by CSRFHandler

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet...

vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response...

Unspecified Vulnerability in Eclipse Vert.x

Eclipse Vert.x is an Eclipse Foundation toolkit for building responsive applications on the JVM , which is mainly used to build applications such as network utilities , Web applications , HTTP/REST microservices and so on. A security vulnerability exists in Eclipse Vert.x versions 3.0.0 through...

Replay Attacks

vertx-web is vulnerable to replay attacks. The application does not validate CSRF Tokens with the returned CSRF header/form parameter, allowing a malicious user to conduct a replay attack with previously issued tokens...

HID discoveryd - 'command_blink_on' Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HID discoveryd commandblinkon Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated remote command execution...

HID discoveryd command_blink_on Unauthenticated Remote Command Execution Exploit

This Metasploit module exploits an unauthenticated remote command execution vulnerability in the discoveryd service exposed by HID VertX and Edge door controllers. This Metasploit module was tested successfully on a HID Edge model EH400 with firmware version 2.3.1.603 Build 04/23/2012. This modul...

HID discoveryd command_blink_on Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HID discoveryd commandblinkon Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated remote command execution...

HID VertX Detection (discoveryd)

Detection of HID VertX Access Control Devices. The script sends a connection request to the server and attempts to detect HID VertX Access Control Devices and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

HTTP Header Injection

vertx-core is vulnerable to HTTP header injections. The library does not validate HTTP header values, allowing attackers to inject arbitrary headers in requests. This vulnerability is a different vulnerability from CVE-2018-12537, however the fix for CVE-2018-12537 remediates this vulnerability...

HID VertX/Edge 'discoverd' Remote Code Execution Vulnerability

HID VertX/Edge is an intelligent access control product from HID Global, USA. A remote code execution vulnerability exists in HID VertX/Edge, which can be exploited by an attacker to execute arbitrary code in an application, and may also result in a denial of service...

HID VertX/Edge Command Injection Remote Code Execution Vulnerability

HID Global offers a networked VertX IP-based access control solution to make gates intelligent. HID Edge has a security vulnerability in the discoverd service due to a failure to effectively filter user data before executing system calls. An attacker exploiting this vulnerability could execute...