Siemens SICAM P850 and SICAM P855 Devices Cross-Site Scripting Vulnerability

The SICAM P850 Multifunctional Measurement Device is used to collect, visualize, evaluate and transmit electrical measurement variables such as AC current, AC voltage, frequency, power, harmonics, etc. The SICAM P855 Multifunctional Device is used to collect, display and transmit measured...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388-Exploit Test and Exploit Scripts for CVE 2022-13...

prometheus/client_golang: Denial of service using InstrumentHandlerCounter

A denial of service attack was found in prometheus/clientgolang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability...

httpd: Request splitting via HTTP/2 method injection and mod_proxy

A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity...

ALSA-2022:1915 Moderate: httpd:2.4 security and bug fix update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Request splitting via HTTP/2 method injection and modproxy CVE-2021-33193 httpd: modproxyuwsgi: out-of-bounds read via a crafted request uri-path CVE-2021-36160 httpd:...

InHand Networks InRouter302 info.jsp cross-site scripting (XSS) vulnerability

Summary A cross-site scripting xss vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions InHand...

NewStart CGSL MAIN 6.02 : gupnp Multiple Vulnerabilities (NS-SA-2022-0060)

The remote NewStart CGSL host, running version MAIN 6.02, has gupnp packages installed that are affected by multiple vulnerabilities: - The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different...

NewStart CGSL CORE 5.05 / MAIN 5.05 : gupnp Vulnerability (NS-SA-2022-0036)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has gupnp packages installed that are affected by a vulnerability: - An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2022-50947)

Fortinet FortiOS is a security operating system dedicated to the FortiGate network security platform from Fortinet, Inc. Fortinet FortiOS is vulnerable to an information leakage vulnerability that results from excessive data output in server-generated error messages, which can be exploited by...

Cyclos 4 PRO Cross-Site Scripting Vulnerability (CNVD-2022-77956)

Cyclos 4 PRO is a web server. a cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which stems from a failure to validate user input during error notification. A remote, unauthenticated attacker could execute javascript code via undefine enumeration constants...

CVE-2019-12254 TECSON/GOK: Improper Authentication and Access Control on multiple devices

In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by...

CVE-2019-12254

CVE-2019-12254 affects Tecson Tankspion and GOKs SmartBox 4 products, where an endpoint that saves settings does not properly restrict access, allowing an unauthenticated user with limited rights to change settings due to weak ACL enforcement. Documents confirm a lack of adequately implemented ac...

TECSON/GOK SmartBox 授权问题漏洞

TECSON/GOK SmartBox is a family of electronic fuel tank management systems from TECSON/GOK, Germany. An authorization issue vulnerability exists in four products in the TECSON/GOK SmartBox family, which arises from a lack of fully implemented access control rules, which could allow a malicious us...

JetBrains IntelliJ IDEA Access Control Error Vulnerability

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from Jetbrains Czech Republic.JetBrains IntelliJ IDEA versions prior to 2022.1 are vulnerable to an access control error vulnerability that stems from a flaw in source checking in the internal web server...

JetBrains IntelliJ IDEA Cross-Site Scripting Vulnerability

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from Jetbrains Czech Republic.A cross-site scripting vulnerability exists in versions prior to JetBrains IntelliJ IDEA 2022.1, which stems from an error message in the internal web server that lacks a...

CVE-2022-25783

Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Secomea GateManager versions prior to 9.7...

CVE-2022-25783

Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Secomea GateManager versions prior to 9.7...

CVE-2022-25783

Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Secomea GateManager versions prior to 9.7...

Input validation

Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Secomea GateManager versions prior to 9.7...

CVE-2022-25783

CVE-2022-25783 concerns an insufficient logging vulnerability in the web server of the Secomea GateManager. Affected product: Secomea GateManager (remote access server) with versions prior to 9.7. Root cause: logged-in users can issue improper queries without those actions being logged, enabling ...