GHSA-H6RP-MPRM-XGCQ plone.rest vulnerable to Denial of Service when ++api++ is used many times

Impact When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected. Workarounds In your frontend web server nginx, Apac...

CVE-2023-42457

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

Server side request forgery (ssrf)

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

CVE-2023-42457 plone.rest vulnerable to Denial of Service when ++api++ is used many times

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

PT-2023-28971 · Withsecure · Withsecure Policy Manager Proxy +1

Name of the Vulnerable Software and Affected Versions: WithSecure Policy Manager version 15 WithSecure Policy Manager Proxy version 15 Description: The issue allows Unauthenticated Remote Code Execution via the web server backend. This is a significant problem as it can be exploited without the...

Siemens LOGO! Web Server Buffer Copy Without Checking Size of Input (CVE-2020-7593)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants V1.81.01 - V1.81.03, LOGO! 8 BM incl. SIPLUS variants V1.82.01, LOGO! 8 BM incl. SIPLUS variants V1.82.02. A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacke...

PT-2023-5636 · Withsecure · Withsecure Policy Manager

Name of the Vulnerable Software and Affected Versions: WithSecure Policy Manager version 15 Description: The issue exists due to insufficient input validation in the WithSecure Policy Manager, allowing an attacker to execute arbitrary code. This can be exploited for unauthenticated remote code...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

Design/Logic Flaw

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

CVE-2023-25528

CVE-2023-25528 affects the NVIDIA DGX H100 baseboard management controller (BMC) web server plugin. An unauthenticated attacker can trigger a stack overflow by sending a specially crafted network packet, potentially leading to arbitrary code execution, denial of service, information disclosure, a...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

Jenkins LTS < 2.414.2 / Jenkins weekly < 2.424 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.414.2 or Jenkins weekly prior to 2.424. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.50 through 2.423 both inclusive, LTS 2.60.1 through...

CVE-2022-47556

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service DoS on the device...

CVE-2022-47553

Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server...

CVE-2022-47553

Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server...

Code injection

UNSUPPPORTED WHEN ASSIGNED Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server...

Information disclosure

UNSUPPPORTED WHEN ASSIGNED Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server...

CVE-2022-47556 Uncontrolled Resource Consumption in Ormazabal products

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service DoS on the device...