U.S. Dept Of Defense: [██████████] — Directory traversal via `/aerosol-bin/███████/display_directory_████_t.cgi`

Description On the domain https://█████████, there is a vulnerable endpoint that lets an attacker preview and browse the whole server including all the server's critical directories such as etc , var, cache etc. located in the root directory of this Linux web server. This vulnerable endpoint is...

File Upload Vulnerability in Website Building System of Guangzhou LEAFCO Network Technology Co.

Ltd. is a website design company that provides website application system, mobile APP application system and WeChat public number for enterprise users. A file upload vulnerability exists in the website building system of Guangzhou LEAF Network Technology Co., Ltd, which can be exploited by an...

File Upload Vulnerability in HadSky Light Forum System

HadSky Light Forum System is a free and open forum system for individual users. A file upload vulnerability exists in the HadSky Light Forum System, which can be exploited by an attacker to gain control of the web server...

Code Execution Vulnerability in OpenSNS

OpenSNS is a lightweight social user center framework based on OneThink. The system adheres to a minimalist design style and focuses on communication. A code execution vulnerability exists in OpenSNS, which can be exploited by an attacker to gain control of the web server...

The vulnerability of the web server of the Cisco Integrated Management Controller, a software-based remote management system for servers, allows a perpetrator to increase their privileges.

The vulnerability of the Cisco Integrated Management Controller, a software-based remote server management system, is related to errors in processing substring comparisons. Exploiting this vulnerability can allow an attacker to increase their privileges through a specially crafted HTTP request...

The vulnerability relates to the implementation of the HTTP/2 network protocol on Windows operating systems, Apache Traffic Server web servers, H2O web servers, network programming tools such as netty, SwiftNIO, Envoy, and the Node.js software platform. This allows attackers to induce service failures.

The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems, Apache Traffic Server web servers, H2O web servers, network programming tools such as netty, SwiftNIO, Envoy, and Node.js software platforms is related to an uncontrolled resource consumption. Exploiting...

CVE-2019-14305

Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for Wi-Fi, mDNS, POP3, SMTP, and notification alerts, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the print...

CVE-2019-14307

CVE-2019-14307 affects Ricoh SP C250DN/C252DN and SP C250SF/SP C252SF printers. Multiple buffer overflows occur while parsing HTTP parameter settings for SNMP, allowing a remote attacker to cause denial of service or execute code via crafted requests to the web server. Affected firmware versions ...

Friday Squid Blogging: Vulnerabilities in Squid Server

It's always nice when I can combine squid and security: Multiple versions of the Squid web proxy cache server built with Basic Authentication features are currently vulnerable to code execution and denial-of-service DoS attacks triggered by the exploitation of a heap buffer overflow security flaw...

[SECURITY] Fedora 30 Update: httpd-2.4.41-1.fc30

The Apache HTTP Server is a powerful, efficient, and extensible web server...

[SECURITY] Fedora 30 Update: nginx-1.16.1-1.fc30

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration Vulnerability

Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS is a set of Linux-based infrastructure software from Cisco. The software is mainly used for designing, deploying and managing network services and dynamically deploying virtualized network functions on supported Cisco...

Cisco UCS C-Series, Cisco UCS S-Series Integrated Management Controller Software License Issue Vulnerability

Cisco UCS C-Series and Cisco UCS S-Series are both products of Cisco Corporation.Cisco UCS C-Series is a C-Series rackmount server.Cisco UCS S-Series is an S-Series rackmount server.Integrated Management Integrated Management Controller IMC Software is a suite of software used to manage the UCS...

Cisco UCS C-Series Servers and UCS S-Series Servers Integrated Management Controller Denial of Service Vulnerability

Cisco Integrated Management Controller IMC is a set of software from the American company Cisco Cisco for the management of UCS Unified Computing System. The software supports HTTP, SSH access, etc., and can perform operations such as powering on, powering off and rebooting the server. A...

HPESBUX03950 rev.1 - HP-UX Web Server Suite running Apache on HP-UX 11iv3, Multiple Remote Vulnerabilities

Potential Security Impact: Local: Unauthorized Disclosure of Information, Unauthorized Modification; Remote: Bypass Security Restrictions, Denial of Service DoS, Unauthorized Disclosure of Information, Unauthorized Modification SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX...

CVE-2019-1907

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by...

CVE-2019-1900

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service DoS condition on an affected system. The vulnerability is due to insufficient validation of...

CVE-2019-1907

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by...

Input validation

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service DoS condition on an affected system. The vulnerability is due to insufficient validation of...

CVE-2019-1907 Cisco Integrated Management Controller Substring Comparison Privilege Escalation Vulnerability

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by...