2577 matches found
Archive_Tar: directory traversal due to inadequate checking of symbolic links
A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences /../ to modify...
PT-2022-19396 · Fortinet · Fortisoar
Name of the Vulnerable Software and Affected Versions: Fortinet FortiSOAR versions prior to 7.2.1 Description: The issue is related to an improper neutralization of special elements used in an OS command, allowing an authenticated attacker to execute unauthorized code or commands via crafted HTTP...
PT-2022-24318 · D Link · D-Link Dir 819
Name of the Vulnerable Software and Affected Versions: D-Link DIR 819 version 1.06 Description: A local file inclusion issue allows attackers to cause a Denial of Service or access sensitive server information via manipulation of the getpage parameter in a crafted web request. This can lead to...
The vulnerability of the Security and Provisioning component of the Oracle Essbase database management system allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Security and Provisioning component of the Oracle Essbase database management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through HTTP requests...
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W allows a perpetrator to execute arbitrary commands or cause service failures.
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W arises from the copying of buffers without checking the size of the input data during the processing of user fields in incoming HTTP packets. Exploiting...
The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software allows a perpetrator to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service disruption.
The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to create, delete, or alter access to critical data, gain read-only access to data, or cause a...
The vulnerability in the web interfaces of Cisco Enterprise Chat and Email allows a perpetrator to carry out cross-site scripting attacks.
The vulnerability of the Cisco Enterprise Chat and Email messaging interfaces exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks using specially crafted HTTP requests...
USN-5576-1 twisted vulnerability
It was discovered that Twisted incorrectly parsed some types of HTTP requests in its web server implementation. In certain proxy or multi-server configurations, a remote attacker could craft malicious HTTP requests in order to obtain sensitive information...
The vulnerability of the Updates Environment Mgmt component of the Oracle PeopleSoft Enterprise PeopleTools business application allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Updates Environment Mgmt component in the Oracle PeopleSoft Enterprise PeopleTools business application exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of...
CVE-2022-2838
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests...
WWBN AVideo 跨站脚本漏洞
WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 11.6, which stems from a specially crafted HTTP request that could lead to arbitrary Javascript execution...
WWBN AVideo 安全漏洞
WWBN AVideo is a video platform builder written in PHP by the WWBN team. A security vulnerability exists in WWBN AVideo version 11.6. An attacker exploits the vulnerability to access and take over resources via specially crafted HTTP requests...
WWBN AVideo 操作系统命令注入漏洞
WWBN AVideo is a video platform builder written in PHP by the WWBN team. An operating system command injection vulnerability exists in WWBN AVideo version 11.6. An attacker can exploit this vulnerability to execute arbitrary commands via specially crafted HTTP requests...
WWBN AVideo 跨站脚本漏洞
WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 11.6. An attacker can exploit this vulnerability to execute arbitrary Javascript via a specially crafted HTTP request...
CVE-2022-20816
A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to delete arbitrary files from an affected system. This...
The vulnerability of the User Interface component of the Oracle Health Sciences Data Management Workbench allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the User Interface component of the Oracle Health Sciences Data Management Workbench exists due to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information through HTTP...
The vulnerability of component E1 in the JD Edwards EnterpriseOne Orchestrator application for business analytics allows a hacker to gain read access to data.
The vulnerability of component E1 in the JD Edwards EnterpriseOne Orchestrator application exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to gain read access to data through HTTP requests...
The vulnerability of the Policy Framework component of the Enterprise Manager Base Platform allows a perpetrator to execute arbitrary code.
The vulnerability of the Policy Framework component of the Enterprise Manager Base Platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code via HTTP requests...
The vulnerability of the Web Runtime component of the JD Edwards EnterpriseOne Tools system allows a perpetrator to gain access to read, modify, add, or delete data, or to cause partial service interruption.
The vulnerability of the Web Runtime component of the JD Edwards EnterpriseOne Tools system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, add, or delete data, or cause a partial service...