CVE-2022-36306

An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still...

CVE-2022-36306

An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still...

Airspan AirVelocity 1500 安全漏洞

The Airspan AirVelocity 1500 is a revolutionary indoor high-performance small cell from Airspan USA. Designed to bring public access LTE networks into indoor spaces A security vulnerability exists in the Airspan AirVelocity 1500 versions 9.3.0.01249 and 15.18.00.2511, which originates from an...

WWBN AVideo 跨站请求伪造漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site request forgery vulnerability exists in WWBN AVideo version 11.6. An attacker exploits the vulnerability to escalate privileges via a specially crafted HTTP request...

prometheus/client_golang: Denial of service using InstrumentHandlerCounter

A denial of service attack was found in prometheus/clientgolang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability...

The vulnerability of the Office Online Server web server, related to insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the Office Online Server web server is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system...

The vulnerabilities of the web server of the microprogramming software for communication modules CP-8000 MASTER MODULE WITH I/O, CP-8021 MASTER MODULE (6MF2802-1AA00), CP-8022 MASTER MODULE WITH GPRS (6MF2802-2AA00) allow attackers to identify the devices used in the network.

The vulnerability of web-servers of microprogramming software for communication modules, such as CP-8000 MASTER MODULE WITH I/O, CP-8021 MASTER MODULE 6MF2802-1AA00, and CP-8022 MASTER MODULE WITH GPRS 6MF2802-2AA00, is related to deficiencies in access control. Exploiting these vulnerabilities...

Splunk Enterprise Deployment Server < 9.0 Improper Authorization

The version of Splunk Enterprise installed on the remote host is prior to 9.0. It may, therefore, be affected by an improper authorization vulnerability if the Deployment Server component is in use where forwarder bundles can be downloaded without authentication. Note that Nessus has not tested f...

Red Hat Undertow 安全漏洞

Red Hat Undertow is a Java-based embedded web server from Red Hat, Inc. and is the default web server for Wildfly Java Application Server. Red Hat Undertow has a security vulnerability that stems from a DoS that can be realized when the Undertow server waits forever for an EJB call to LASTCHUNK...

CVE-2021-46304

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions, CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions, CP-8021 MASTER MODULE All versions, CP-8022 MASTER MODULE WITH GPRS All versions. The component allows to activate a web server module which provide...

Design/Logic Flaw

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions, CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions, CP-8021 MASTER MODULE All versions, CP-8022 MASTER MODULE WITH GPRS All versions. The component allows to activate a web server module which provide...

CVE-2021-46304

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions, CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions, CP-8021 MASTER MODULE All versions, CP-8022 MASTER MODULE WITH GPRS All versions. The component allows to activate a web server module which provide...

CVE-2021-46304

CVE-2021-46304 affects Siemens SICAM A8000/Web Server Module products (CP-8000 series and CP-8021/CP-8022). The issue is improper access control: the web server module can be activated to provide unauthenticated access to its web pages, enabling retrieval of debug information (e.g., internal netw...

The vulnerability of the httpd module in DD-WRT microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the httpd module in DD-WRT microprogramming software is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted HTTP request...

Siemens SICAM A8000 CP-8000 安全漏洞

The SICAM A8000 RTU Remote Terminal Unit series is a modular device family for remote control and automation applications in all energy supply areas.An authentication bypass vulnerability exists in the Siemens SICAM A8000 Web Server Module, which is caused by the component allowing the activation...

Siemens SICAM A8000 Web Server Module Authentication Bypass Vulnerability

The SICAM A8000 RTU Remote Terminal Unit series is a modular device family for remote control and automation applications in all energy supply areas.An authentication bypass vulnerability exists in the Siemens SICAM A8000 Web Server Module, which is caused by the component allowing the activation...

PT-2022-4104 · Unknown · Cp-8000 Master Module With I/O -40/+70°C +3

Name of the Vulnerable Software and Affected Versions: CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions CP-8021 MASTER MODULE All versions CP-8022 MASTER MODULE WITH GPRS All versions Description: A vulnerability has been identified in th...

Siemens SICAM A8000 Web Server Module

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SICAM A8000 CP-8000, CP-8021, CP-8022 Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthenticated access to the...

Backdoor.Win32.Guptachar.20 MVID-2022-0631 Insecure Credential Storage

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/857999d2306f257b80d1b8f6a51ae8b0.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Guptachar.20 Vulnerability: Insecure Credential Storage Description: The...

PT-2022-4062 · Dd-Wrt · Dd-Wrt

Name of the Vulnerable Software and Affected Versions: DD-WRT versions Revision 32270 through Revision 48599 Description: The issue is related to insufficient input validation in the httpd module of DD-WRT, which can be exploited by sending a specially-crafted HTTP request to execute arbitrary...