httpd: mod_lua: Use of uninitialized value of in r:parsebody

A flaw was found in the modlua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The highest threat from this vulnerability is to system availability...

httpd: mod_lua: Information disclosure with websockets

A flaw was found in the modlua module of httpd. The data returned by the wsread function may point past the end of the storage allocated for the buffer, resulting in information disclosure...

Privilege escalation

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...

CVE-2022-45183

The CVE-2022-45183 vulnerability affects Ironman Software PowerShell Universal 2.x and 3.x Web Server and enables privilege escalation: an attacker possessing a valid app token can retrieve other app tokens by ID via an HTTP request. The issue is rated high (CVSS v3.1 base score 8.8) with network...

The vulnerability of the HTTP server software of Moxa MGate MB3180, MB3280, and MB3480 allows attackers to gain unauthorized access to protected information or enhance their privileges.

The vulnerability of the HTTP server software for Moxa MGate MB3180, MB3280, and MB3480 relates to the transmission of data in an open manner. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information or enhance their privileges...

CVE-2022-45183

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...

Multiple High-Severity Flaws Affect Widely Used OpenLiteSpeed Web Server Software

Multiple high-severity flaws have been uncovered in the open source OpenLiteSpeed Web Server as well as its enterprise variant that could be weaponized to achieve remote code execution. "By chaining and exploiting the vulnerabilities, adversaries could compromise the web server and gain fully...

Cisco Firepower Threat Defense Resource Management Error Vulnerability (CNVD-2022-78144)

Cisco Firepower Threat Defense FTD Software is a unified set of software from Cisco that provides next-generation firewall services.A resource management error vulnerability exists in Cisco Firepower Threat Defense FTD Software, which stems from its management web server Failure to properly...

[SECURITY] Fedora 37 Update: nginx-1.22.1-1.fc37

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

CVE-2022-20949

CVE-2022-20949 describes a privilege-escalation flaw in the management web server of Cisco Firepower Threat Defense (FTD) Software. An authenticated, remote attacker with high privileges could issue configuration commands on the affected system due to improper access control of HTTPS endpoints, w...

CVE-2022-29888

A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-34579

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download...

CVE-2021-34579

Phoenix Contact FL MGUARD DM versions 1.12.0 and 1.13.0 expose an Apache web server on Windows without required login, allowing network attackers to download ATV profiles containing sensitive data (e.g., IPsec private keys). The root cause is insufficient access control for the web server embedde...

CVE-2021-34579 PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download...

CVE-2021-34579 PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download...

Cisco Firepower Threat Defense Software Privilege Escalation Vulnerability

A vulnerability in the management web server of Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This vulnerability exists because access to HTTPS endpoints is not properly...

PT-2022-5810 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the management web server of Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker with high...

Cisco Firepower Threat Defense 安全漏洞

Cisco Firepower Threat Defense FTD Software is a unified set of software from Cisco that provides next-generation firewall services.A resource management error vulnerability exists in Cisco Firepower Threat Defense FTD Software, which stems from its management web server Failure to properly...

httpd: mod_sed: Read/write beyond bounds

An out-of-bounds read/write vulnerability was found in the modsed module of httpd. This flaw allows an attacker to overwrite the memory of an httpd instance that is using modsed with data provided by the attacker...

Siemens Web Server Login Page of Industrial Controllers

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...