CVE-2021-1460

A vulnerability in the Cisco IOx Application Framework of Cisco 809 Industrial Integrated Services Routers Industrial ISRs, Cisco 829 Industrial ISRs, Cisco CGR 1000 Compute Module, and Cisco IC3000 Industrial Compute Gateway could allow an unauthenticated, remote attacker to cause a denial of...

Code injection

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to ...

GHSA-4P9G-QGX9-397P Denial of Service in Page Error Handling

Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C 5.5 CWE-405, CWE-674 Status: DRAFT Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a...

Denial of Service in Page Error Handling

Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C 5.5 CWE-405, CWE-674 Status: DRAFT Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a...

File Upload Vulnerability in Ke361

Ke361 is an open source Taobao system. Ke361 suffers from a file upload vulnerability that can be exploited by attackers to gain control of a web server...

Denial of Service in Page Error Handling

Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack...

USN-4848-1 mini-httpd vulnerability

It was discovered that ACME minihttpd did not properly handle HTTP GET requests with empty headers. A remote attacker could use this vulnerability to read arbitrary files...

Command Execution Vulnerability in MCMS

MCMS is a development template based on SpringBoot 2 architecture , front-end based on vue, element ui . MCMS suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the web server...

The vulnerability in the HTTP Server TCP/IP stack of Track allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the HTTP Server TCP/IP stack in Track involves insufficient validation of input data during packet processing. Exploiting this vulnerability allows an attacker to cause service failures or execute arbitrary code...

The vulnerability of the configuration of Siemens SICAM integrated web-server microprogramming software for remote terminals allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the configuration of the integrated web-server microprogramming software for Siemens SICAM remote terminals is related to insufficient data protection. Exploiting this vulnerability can allow an intruder operating remotely to gain unauthorized access to protected information...

The vulnerability of the `check_forbidden` function in the rack/directory.rb module interface between web servers and Rack web applications allows a violator to access confidential data.

The vulnerability of the checkforbidden function in the rack/directory.rb module of the Rack framework, which is used between web servers and web applications, relates to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain...

Command Execution Vulnerability in OneThink

OneThink is an open source content management framework. OneThink suffers from a command execution vulnerability that can be exploited by an attacker to gain control of a web server...

File upload vulnerability exists in YZNCMS backend

YZNCMS is a CMS content management system based on the latest TP5.1 framework. YZNCMS has a file upload vulnerability in the backend, which can be exploited by attackers to gain control of the web server...

Command execution vulnerability exists in OneThink (CNVD-2021-22773)

OneThink is an open source content management framework. OneThink suffers from a command execution vulnerability that can be exploited by an attacker to gain control of a web server...

The vulnerability in the `parse_cookies_header` function of the `utils.rb` module in the Rack web server and web application interface allows a attacker to compromise data integrity.

The vulnerability of the parsecookiesheader function in the utils.rb module of the Rack web server and web application interface is related to the lack of a mechanism for checking input data. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

HTTP Bridge - Send TCP Stream Packets Over Simple HTTP Request

I've wrote this program as a proof of concept to test the idea of be able to send tcp stream packets over simple http request like PUT, PATCH, POST, GET, without use a proxy way like CONNECT method. Also as a practice exercise to train my novice skill on rust language. Description These tool is...

CVE-2020-24984

An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server...

CVE-2020-24984

An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server...

Cross site request forgery (csrf)

An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server...

CVE-2020-24984

CVE-2020-24984 affects Quadbase EspressReports ES 7 Update 9. A CSRF flaw could allow an attacker to trick an authenticated admin-level user into uploading malicious files to the web server. The connected documents confirm the vulnerability description across vendors (Red Hat, NVD, CVE list, PRIO...