22140 matches found
CVE-2025-67447: Improper Neutralization of Special Elements used in an OS Command
The network diagnosis ping module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands,...
CVE-2025-67447
The CVE concerns the ping module in Neterbit NW-431F Router (versions up to 20241014-IR03) with OS command injection via unsanitized IP address input fed to the system ping. The input validation flaw allows an attacker to inject arbitrary commands, which would run with the web server’s privileges...
PT-2026-46292
Name of the Vulnerable Software and Affected Versions Neterbit NW-431F Router versions prior to 20241014-IR03 Description The network diagnosis ping module allows OS command injection because the application fails to properly sanitize user input in the IP address field before passing it to the...
Acer M6E 安全漏洞
The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from the hardcoded backend API keys generated by the M3WebServer, which can be easily intercepted through detailed error handling...
RockyLinux 10 : httpd (RLSA-2026:21433)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21433 advisory. httpd: modproxyajp: heap-based buffer over-read and memory disclosure in ajpparsedata CVE-2026-34059 httpd: modproxyajp: heap-based buffer over-read du...
GHSA-6VR3-7WCX-V5G5 browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
Summary The HTTP handler /log in lib/server.js lines 491–515 of browserstack-runner passes unauthenticated user-supplied data to vm.runInNewContext combined with eval, enabling a sandbox escape and arbitrary code execution on the host system. Details When browserstack-runner starts, it creates an...
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
Summary The HTTP server in browserstack-runner serves files from the project directory via the default handler. This handler uses path.joinprocess.cwd, uri to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on 0.0.0....
Directory Traversal
Overview browserstack-runner is an A command line interface to run browser tests over BrowserStack Affected versions of this package are vulnerable to Directory Traversal via the default handler in the HTTP server. An attacker can access arbitrary files on the host filesystem by sending crafted...
Directory Traversal
Overview org.webjars.npm:browserstack-runner is an A command line interface to run browser tests over BrowserStack Affected versions of this package are vulnerable to Directory Traversal via the default handler in the HTTP server. An attacker can access arbitrary files on the host filesystem by...
GHSA-8RPW-6CQH-2V9H browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
Summary The HTTP server in browserstack-runner serves files from the project directory via the default handler. This handler uses path.joinprocess.cwd, uri to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on 0.0.0....
coruna
iOS Orchestrator — Coruna Web server, C2 listener, and intera...
Linux Distros Unpatched Vulnerability : CVE-2026-49975
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP requests. This issue...
The vulnerability of the modular interface of the Ruby-based Rack web server allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Ruby-based Rack web server’s modular interface is related to the use of a regular expression, which does not sufficiently restrict the set of allowed values. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
The vulnerability of the modular interface of the Ruby-based Rack web server allows a hacker to trigger a service failure.
The vulnerability of the Ruby-based Rack web server’s modular interface is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...
The vulnerability of the modular interface of the Ruby-based Rack web server allows attackers to bypass existing security mechanisms.
The vulnerability of the Ruby-based Rack web server’s modular interface is related to improper behavior. Exploiting this vulnerability allows a remote attacker to bypass existing security mechanisms...
The vulnerability of the modular interface of the Ruby-based Rack web server allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Ruby-based Rack web server’s modular interface is related to partial comparison. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the modular interface of the Ruby-based Rack web server allows attackers to circumvent security restrictions.
The vulnerability of the Ruby-based Rack web server’s modular interface is related to the occurrence of interpretation conflicts when processing HTTP headers’ names and values. Exploiting this vulnerability allows a remote attacker to bypass security restrictions...
CVE-2026-49144
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside...
CVE-2026-49144
CVE-2026-49144 : BrowserStack Runner 0.9.5 contains a path traversal vulnerability in the _default HTTP handler (lib/server.js) that allows unauthenticated attackers on the network-adjacent interface to read arbitrary files outside the project root. The description notes an unauthenticated HTTP s...