2828 matches found
PT-2023-15403 · Ekorccp +1 · Ekorccp +1
Name of the Vulnerable Software and Affected Versions: ekorCCP affected versions not specified ekorRCI affected versions not specified Description: The lack of web request control on devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged i...
PT-2023-6629 · Mastodon · Mastodon
Name of the Vulnerable Software and Affected Versions: Mastodon versions 4.2.0-beta1 through 4.2.0-rc1 Description: The issue is related to insufficient request validation on the server side, allowing attackers to inject arbitrary data into HTTP requests issued by Mastodon. This can be used to...
PT-2023-15401 · Ekorccp +1 · Ekorccp +1
Name of the Vulnerable Software and Affected Versions: ekorCCP and ekorRCI affected versions not specified Description: The issue is related to a lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customized requests to execute malicious actions when a...
Fedora: Security Advisory for rubygem-actionpack (FEDORA-2023-4f0bb4ff5e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
IceWarp Mail Server Input Validation Error Vulnerability
IceWarp Mail Server is a mail server product from the Czech company IceWarp IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A security vulnerability exists in IceWarp Mail Server Deep Castle 2 v.13.0.1.2, which originates from a vulnerability...
Fortinet FortiSIEM Security Vulnerability
Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation, and unified management. A security vulnerability exists in Fortinet FortiSIEM versions 6.7.0 throu...
Fortinet FortiWeb Security Vulnerability
Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists in Fortinet...
The vulnerability of the data exchange software between SCADA systems, Triangle MicroWorks SCADA Data Gateway (SDG), allows a intruder to upload arbitrary files.
The vulnerability of the data exchange software between SCADA systems is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to upload arbitrary files by sending a specially crafted HTTP request...
The vulnerability of the Fusion File Manager component in the PHP-Fusion CMS system allows a hacker to gain access to read and modify files.
The vulnerability of the Fusion File Manager CMS system’s PHP-Fusion component is related to an incorrect limitation on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to gain access to and modify files through a specially created HTTP request...
The vulnerability in the HTTP request basket service interface allows a attacker to perform an SSRF attack.
The vulnerability of the web service interface for collecting and checking HTTP requests related to Request Baskets is related to insufficient validation of incoming requests when processing the name parameter /api/baskets/name. Exploiting this vulnerability allows a malicious actor to perform an...
PT-2023-28697 · Beyondtrust · Beyondtrust Remote Support +1
Name of the Vulnerable Software and Affected Versions: BeyondTrust Privileged Remote Access PRA and Remote Support RS versions 23.2.1 through 23.2.2 Description: The issue is a command injection vulnerability that can be exploited through a malicious HTTP request, allowing an unauthenticated remo...
Mozilla Firefox 缓冲区错误漏洞
Mozilla Firefox ESR is an open source web browser from the Mozilla Foundation. Mozilla Firefox ESR suffers from a memory corruption vulnerability that can be exploited by a remote attacker to submit a specially crafted WEB request, which can be tricked into being parsed by the user and can cause...
CP-Plus DVR 输入验证错误漏洞
CP-Plus DVR is a digital video recorder from CP-Plus. A security vulnerability exists in CP-Plus DVR that stems from incorrect input validation, which allows an unauthenticated, remote attacker to change the system time of a target device by sending a specially crafted HTTP request to the...
The vulnerability of the Node.js software platform, related to deficiencies in HTTP request processing, allows a perpetrator to carry out a “HTTP request hijacking” attack.
The vulnerability of the Node.js software platform is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to carry out an “HTTP request hijacking” attack...
UBUNTU-CVE-2023-40175
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent ...
CVE-2023-2271
The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack...
The vulnerability of the Network Time Protocol determination function of the Zyxel NBG6604 switch allows a perpetrator to execute operating system commands.
The vulnerability of the Network Time Protocol NTP function of the Zyxel NBG6604 switch lies in the possibility of executing commands. Exploiting this vulnerability allows a remote attacker to execute operating system commands by sending a specially crafted HTTP request...
CVE-2023-33013
A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01ABIR.1C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request...
Zyxel NBG6604 操作系统命令注入漏洞
The Zyxel NBG6604 is a dual-band wireless router from China's Hopkins Zyxel. The Zyxel NBG6604 V1.01ABIR.1C0 suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters, commands, etc. in the NTP function. An attacker can...
