Microweber 输入验证错误漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in the GitHub repository microweber/microweber prior to...

CVE-2021-46353

An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP request and gain knowledge of different absolute paths that are being used by the web application...

Fortinet FortiWLM Path Traversal Vulnerability

Fortinet FortiWLC is a wireless LAN controller from Fortinet, Inc. A path traversal vulnerability exists in Fortinet FortiWLC, which can be exploited by an authenticated attacker to retrieve arbitrary files from the underlying file system via a specially crafted Web request...

Fortinet FortiWLM 路径遍历漏洞

Fortinet FortiWLC is a wireless LAN controller from Fortinet, Inc. A path traversal vulnerability exists in Fortinet FortiWLC, which can be exploited by an authenticated attacker to retrieve arbitrary files from the underlying file system via a specially crafted Web request...

Fortinet FortiMail 输入验证错误漏洞

Fortinet FortiMail is a suite of email security gateway products from Fortinet, Inc. The product provides email security protection and data protection, among other features.An input validation error vulnerability exists in the FortiMail Web server CGI facility. An unauthenticated attacker could...

The vulnerabilities of the SAP NetWeaver software integration platform, the SAP Content Server content server, and the SAP Web Dispatcher web dispatcher are related to deficiencies in HTTP request processing. This allows attackers to inject arbitrary code.

The vulnerability of the execute function in SAP software, specifically SAP ContentServer, and the software of SAP NetWeaver – the Content Server and the SAP Web Dispatcher – are related to HTTP request processing vulnerabilities. Exploiting these vulnerabilities allows a malicious actor to injec...

CVE-2022-26155

An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body...

Lansweeper SQL注入漏洞

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. Lansweeper lansweeper EchoAssets.aspx suffers from a SQL injection vulnerability that can be triggered by an attacker making an authenticated...

CVE-2022-25062

TP-LINK TL-WR840NESV6.20180709 was discovered to contain an integer overflow via the function dmcheckString. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

ELM : When we click on upgrade and try to browse we get the error : there was an error on processing web request : status code 400 (bad Request ) : Bad Request

Error : there was an error on processing web request : status code 400 bad Request : Bad Request...

Tp-link TL-WR840N 输入验证错误漏洞

The Tp-link TL-WR840N is a wireless router from Tp-link, China.The Tp-link TL-WR840N is vulnerable to an integer overflow vulnerability that can be exploited by attackers to cause a denial of service DoS via a specially crafted HTTP request...

PT-2022-5090 · Pallets +1 · Werkzeug +1

Name of the Vulnerable Software and Affected Versions: Pallets Werkzeug versions 2.1.0 and below Description: The issue is related to improper parsing of HTTP requests, which can allow an attacker to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included insid...

Server crash if running Python 3.10 w/ Sanic 20.12

!!! ONLY APPLIES TO VERSIONS PRIOR TO Sanic v20.12 WHEN USING Python 3.10 !!! Sanic v20.12 officially supports Python versions 3.6, 3.7, 3.8, and 3.9. However, if you accidentally run it with version 3.10 which is not supported by Sanic 20.12, your server is prone to crashing on an incoming web...

PT-2022-2170

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR840NES version V6.20 180709 Description The issue is related to an integer overflow in the dm checkString function of the libcmm.so module in the TP-Link TL-WR840NES router's firmware. This can be exploited by sending a crafted HT...

CVE-2022-23633

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

CVE-2021-22785

A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 Versions prior to V3.40, Modicon M340 X...

Out of bounds read in json-smart

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions prior to 1.3.3 and 2.4.5 which causes a denial of service DOS via a crafted web request...

Rockwell Automation MicroLogix Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2016-0868)

Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-...

CVE-2022-22833

An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request...

The vulnerability of the `path_getbbox` function in the Python Pillow image processing library, related to an incorrect path limitation for the directory, allows a hacker to gain access to arbitrary files on the system.

The vulnerability of the pathgetbbox function in the Python Pillow image processing library is related to an incorrect path limitation for the directory. Exploiting this vulnerability could allow a malicious actor to gain access to arbitrary files on the system by sending a specially crafted HTTP...