undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2018-1067

It was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value...

tinylcy Vino Input Validation Error Vulnerability

tinylcy Vino is a web server written in the C language. An input validation error vulnerability exists in tinylcy Vino 2017-12-15 and earlier versions, which can be exploited by remote attackers to cause a denial of service with the help of longer URLs...

CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

Apple Tackles Over a Dozen Bugs in its Catalina 10.15 Update

Apple wasted little time snuffing out bugs in its macOS Catalina operating system. On Tuesday, Apple rolled out 16 patches addressing a wide range of Catalina bugs in components such as CoreAudio, IOGraphics and WebKit. The security fixes are exclusively for macOS 10.15; so pre-Catalina releases ...

PHP 7.3.x < 7.3.10 Heap-Based Buffer Overflow Vulnerability.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.10. It is, therefore, affected by a heap-based buffer overflow vulnerability in its mberegi component due to insufficient validation of user input. An unauthenticated, remote attacker can exploit...

Exploit for Cross-site Scripting in Dnnsoftware Dotnetnuke

CVE-2019-12562 !CVE-2019-12562https://mayaseven.com/wp-cont...

The vulnerability of the Cisco IOS XE operating system’s HTTP server allows a hacker to trigger a service failure.

The vulnerability of the Cisco IOS XE operating system’s HTTP server is related to a logical error in the logging mechanism. Exploiting this vulnerability can allow an attacker to cause a service failure...

Cross site scripting

A vulnerability in Cisco Unified Contact Center Express UCCX Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system...

CVE-2019-15259 Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability

A vulnerability in Cisco Unified Contact Center Express UCCX Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system...

CVE-2019-15259 Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability

A vulnerability in Cisco Unified Contact Center Express UCCX Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system...

Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability

A vulnerability in Cisco Unified Contact Center Express UCCX Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system...

The vulnerability of the my_parse_cookie function in the web server of the MOXA EDR-810 industrial router allows a hacker to execute arbitrary code.

The vulnerability of the myparsecookie function offset 0x1B014 on the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router arises due to the lack of checks on the size of the data being copied into a buffer of 0x40 bytes. Exploiting this vulnerability allows an...

The vulnerability of the `my_parse_cookie_if_key_exists` function in the web server of the MOXA EDR-810 industrial router allows a hacker to execute arbitrary code.

The vulnerability of the myparsecookieifkeyexists function offset 0x1B698 on the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router arises due to the lack of checking the size of the data being copied into a buffer of 0x40 bytes. Exploiting this vulnerability...

The vulnerability of the websSecurityHandler function in the MOXA EDR-810 industrial router’s web server allows a hacker to execute arbitrary code.

The vulnerability of the websSecurityHandler function offset 0x1B4B0 in the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router is caused by the lack of checking the size of the data being copied into a buffer of 0x200 bytes. Exploiting this vulnerability allows ...

Multiple vulnerabilities exist in the my_parse_url function of the MOXA EDR-810 industrial router’s web server. These vulnerabilities allow attackers to execute arbitrary code.

The multiple vulnerabilities of the myparseurl function offset 0x16748 in the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router are caused by a lack of checking data size when copying data into a buffer of 0x80 bytes. Exploitation of this vulnerability allows a...

Security Bulletin: IBM Security Guardium is affected by a FileServer functionality vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4292 DESCRIPTION: IBM Security Guardium could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable web server. CV...

Rocket.Chat Cross Site Scripting

Title: Rocket.Chat - Cross Site Scripting Exploit Token Hijack + Product: Rocket.Chat + Vendor: https://rocket.chat/ + Vulnerable Versions: Rocket.Chat 2. Open a chat session 3. Send payload with your web server url 4. Token will be written in logs.txt when target seen your message...

[SECURITY] Fedora 29 Update: httpd-2.4.41-1.fc29

The Apache HTTP Server is a powerful, efficient, and extensible web server...

Atlassian JIRA Service Desk Path Traversal Vulnerability (2019-09-18)

According to its self-reported version number, the instance of Atlassian Service Desk hosted on the remote web server is prior to 3.9.16, 3.1x.x prior to 3.16.8, 4.0.x prior to 4.1.3, 4.2.x prior to 4.2.5, 4.3.x prior to 4.3.4, 4.4.x prior to 4.4.1. It is, therefore, affected by an url path...