CVE-2022-22494

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-crafted HTTP request. This information could then be used in future attacks. IBM X-Force ID: 226940...

IBM Spectrum Protect Operations Center 安全漏洞

IBM Spectrum Protect Operations Center is a software from IBM USA that provides visual control for the IBM Spectrum Protect environment. IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.14 versions contain an information disclosure vulnerability that can be exploited by an...

The vulnerability of the Guzzle client HTTP library, a PHP programming language interpreter, stems from improperly implemented security checks for standard elements, allowing attackers to disclose sensitive information.

The vulnerability of the Guzzle client HTTP library, a programming language interpreter for PHP, is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information...

python-urllib3: CRLF injection via HTTP request method

A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrit...

CVE-2022-31395

Algo Communication Products Ltd. 8373 IP Zone Paging Adapter Firmware 1.7.6 allows attackers to perform a directory traversal via a web request sent to /fm-data.lua...

Directory traversal

Algo Communication Products Ltd. 8373 IP Zone Paging Adapter Firmware 1.7.6 allows attackers to perform a directory traversal via a web request sent to /fm-data.lua...

CVE-2022-31395

Algo Communication Products Ltd. 8373 IP Zone Paging Adapter Firmware 1.7.6 allows attackers to perform a directory traversal via a web request sent to /fm-data.lua...

got 安全漏洞

got is a user-friendly and powerful HTTP request library for Node.js. A security vulnerability exists in versions of got prior to 12.1.0 that originates from allowing redirection to UNIX sockets...

UBUNTU-CVE-2022-26377

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions...

CVE-2022-29013

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request...

VulnCheck KEV: CVE-2016-2388

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request...

python-twisted: possible http request smuggling

A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length header, '\n and \t' etc. Non-conformant parsing leads to a desync if requests pass through multiple HTT...

Carrier LenelS2 HID Mercury access panels 路径遍历漏洞

Carrier LenelS2 HID Mercury access panels is a controller panel from Carrier, U.S. A path traversal vulnerability exists in Carrier LenelS2 HID Mercury access panels, which could be exploited to send specially crafted HTTP requests to upload arbitrary files to an arbitrary location on the system...

CVE-2022-20802

A vulnerability in the web interface of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by...

Pallets Werkzeug 环境问题漏洞

Pallets Werkzeug is a WSGI web application library. An environmental issue vulnerability exists in Pallets Werkzeug version 2.1.0 and prior versions that stems from incorrectly parsing HTTP requests. An attacker could use this vulnerability to perform HTTP request smuggling via a specially crafte...

Denial of service in .NET core

.NET Core and Visual Studio Denial of Service Vulnerability due to a vulnerability which exists when creating HTTPS web request during X509 certificate chain building...

GHSA-3CF7-7WQ6-8842 ASP.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'...

GHSA-RF8F-HQJV-986P Shopware Insecure Deserialization Vulnerability

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

Shopware Insecure Deserialization Vulnerability

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

TotoLink A3100R Access Control Error Vulnerability (CNVD-2022-54651)

TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R versions V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to an access control error, which could be exploited by attackers to to obtain sensitive information via a crafted web request...