CVE-2024-22529

TOTOLINK X2000RV2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub449040 handle function of formUploadFile of /bin/boa...

curl: Incorrect handling of control code characters in cookies

A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies from an HTTPS server, where it accepts cookies using control codes byte values below 32, and also when cookies that contain such control codes are later sent back to an HTTPS server, possibly...

haproxy: Proxy forwards malformed empty Content-Length headers

A flaw was found in HAProxy. Empty Content-Length headers are forwarded, which could cause an HTTP/1 server behind it to interpret the payload as an extra request. This may render the HTTP/1 server vulnerable to attacks in some uncommon cases...

The vulnerability of the Nginx UI server’s user interface allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Nginx UI server’s user interface relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Web Server component of the Oracle BI Publisher software, which is used for creating reports, allows a perpetrator to compromise data confidentiality and integrity.

The vulnerability of the Web Server component of the Oracle BI Publisher software exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of data...

VulnCheck KEV: CVE-2022-25322

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...

EFS Software Easy File Sharing (EFS) Web Server Security Vulnerability

Efs Software EFS Software Easy File Sharing EFS Web Server is a suite of file sharing software from the Dutch company Efs Software. The software includes a forum site, file uploading, downloading, sharing and image sharing. A security vulnerability exists in EFS Software Easy File Sharing EFS Web...

Mitsubishi Electric MELSEC iQ-F/iQ-R Series CPU Module Improper Restriction of Excessive Authentication Attempts (CVE-2023-4625)

Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after t...

haproxy: Proxy forwards malformed empty Content-Length headers

A flaw was found in HAProxy. Empty Content-Length headers are forwarded, which could cause an HTTP/1 server behind it to interpret the payload as an extra request. This may render the HTTP/1 server vulnerable to attacks in some uncommon cases...

PT-2024-11031 · Karjasoft · Karjasoft Sami Http Server

Name of the Vulnerable Software and Affected Versions: Karjasoft Sami HTTP Server version 2.0 Description: A vulnerability was found in the HTTP HEAD Request Handler component of the Karjasoft Sami HTTP Server. The manipulation of this component leads to denial of service. It is possible to launc...

HPESBUX04589 rev.1 - HP-UX Apache Web Server, Multiple Vulnerabilities

Potential Security Impact: Local: Access Restriction Bypass, Bypass Security Restrictions, Disclosure of Information, Server-Side Request Forgery SSRF, memory corruption; Remote: Access Restriction Bypass, Bypass Security Restrictions, Disclosure of Information, Server-Side Request Forgery SSRF,...

CVE-2024-20987

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks...

CVE-2024-20979

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

Design/Logic Flaw

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks...

CVE-2024-20979

Oracle BI Publisher (Oracle Analytics) contains CVE-2024-20979 affecting Web Server component. Affected versions: 6.4.0.0.0, 7.0.0.0.0, and 12.2.1.4.0. The vulnerability is exploitable over HTTP with network access by a low-privileged user and user interaction is required. Impact includes potenti...

PT-2024-1220 · Oracle · Oracle Bi Publisher

Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 6.4.0.0.0 and 7.0.0.0.0 Description: The issue exists due to insufficient input validation in the Web Server component of Oracle BI Publisher. This allows a remote attacker to compromise the confidentiality and...

PT-2024-1539 · Oracle · Oracle Bi Publisher

Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher version 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Web Server component of Oracle BI Publisher. This allows a low-privileged attacker with network access via HTTP to compromise...

CVE-2023-50729

Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root...

CVE-2024-0542

A vulnerability was found in Tenda W9 1.0.0.74456. It has been rated as critical. Affected by this issue is the function formWifiMacFilterGet of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has...

CVE-2024-0540

A vulnerability was found in Tenda W9 1.0.0.74456. It has been classified as critical. Affected is the function formOfflineSet of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has bee...