CVE-2021-38975

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 212780...

UBUNTU-CVE-2021-22959

The parser in accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS in llhttp v2.1.4 and v6.0.6...

Lantronix PremierWave 路径遍历漏洞

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. Used to provide reliable and always-on 5G Wi-Fi connectivity, the Lantronix PremierWave 2050 is vulnerable to a path traversal vulnerability that can be exploited by attackers to cause local file inclusion...

Lantronix PremierWave 路径遍历漏洞

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. Used to provide reliable and always-on 5G Wi-Fi connectivity, the Lantronix PremierWave 2050 is vulnerable to a path traversal vulnerability that can be exploited by attackers to cause local file inclusion...

Lantronix PremierWave 2050 操作系统命令注入漏洞

The Lantronix PremierWave 2050 is an embedded Wi-Fi module manufactured by Lantronix. The Lantronix PremierWave 2050 is vulnerable to an operating system command injection vulnerability that could be exploited by an attacker to cause arbitrary command execution in the "EC keypasswd" parameter wit...

CVE-2021-38975

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 212780...

haproxy: request smuggling attack or response splitting via duplicate content-length header

Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while...

Vulnerability fixed in FortiWeb

A vulnerability has been fixed in FortiWeb. The vulnerability allows an unauthenticated malicious person who is in the network of the victim is able to execute arbitrary code by sending a rogue HTTP request. Fortinet made few substantive details available. Fortinet has released updates to fix the...

Meross Smart Wi-Fi 2 Way Wall Switch 安全漏洞

The Meross Smart Wi-Fi 2 Way Wall Switch is a smart device from China-based Meross Technology Meross. A security vulnerability exists in the Meross Smart Wi-Fi 2 Way Wall Switch MSS550X that could allow a remote attacker to obtain the Wi-Fi SSID and user-configured password from the Meross...

PT-2021-21854 · Meross · Meross Smart Wi-Fi 2 Way Wall Switch

Name of the Vulnerable Software and Affected Versions: Meross Smart Wi-Fi 2 Way Wall Switch MSS550X versions 3.1.3 and earlier Description: The issue allows a remote attacker to obtain the Wi-Fi SSID and the password configured by the user from the Meross app via an Http/JSON plain request. This ...

VulnCheck KEV: CVE-2020-3452

Cisco Adaptive Security Appliance ASA and Firepower Threat Defense FTD contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an...

CVE-2021-35570

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

ShinHer StudyOnline System 授权问题漏洞

ShinHer StudyOnline System is a school system from ShinHer, a Chinese company. ShinHer StudyOnline System is vulnerable to an authorization issue that stems from the Study Edit feature of ShinHer StudyOnline System without permission control. An attacker could use this vulnerability to access and...

The vulnerability in the VMI web interface of vCenter Server Appliance, a management tool for VMware vCenter Server virtual infrastructure, allows an attacker to gain unauthorized access to protected information.

The vulnerability in the VCenter Server Management Interface of the VMware vCenter Server web interface relates to deficiencies in system security restrictions. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending a specially crafte...

nodejs 环境问题漏洞

nodejs is a JavaScript runtime environment based on the ChromeV8 engine by wrapping the Chromev8 engine as well as the use of event-driven and non-blocking IO applications to make the development of high-performance backend applications in Javascript possible. Nodejs An environment issue...

PT-2021-8119 · Apache +5 · Apache Traffic Server +6

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 5.5.1 and 4.3.9 Description: The issue is related to HTTP request smuggling when using Puma with a proxy that forwards HTTP header values containing the LF character. This could allow a client to smuggle a request throu...

The vulnerability of the Apache HTTP Server’s web server, related to path checking failures, allows attackers to execute arbitrary code.

The vulnerability of the Apache HTTP Server is related to deficiencies in path checking for directories. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP request...

Vulnerability fixed in Fortinet FortiSandbox

Fortinet has fixed a vulnerability in FortiSandbox. A authenticated malicious party could potentially abuse the vulnerability to execute arbitrary code. To do so, a rogue HTTP request must be sent to the FortiSandbox appliance. sent. Fortinet has released updates to fix the vulnerability in...

Emerson WirelessHART Gateway SQL注入漏洞

The Emerson WirelessHART Gateway is a wireless gateway from Emerson USA. Emerson WirelessHART Gateway suffers from a SQL injection vulnerability that originates from an input validation error when processing a directory traversal sequence. An attacker could use this vulnerability to send a...

CVE-2021-33600

A denial-of-service DoS vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attacker can trigger assertion via malformed HTTP packet to web interface. An unauthenticated attacker could exploit this vulnerability by sending...