PT-2020-4927 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue concerns a problem with the QuickConnect feature in Synology Router Manager, which allows for a man-in-the-middle attack. This could enable an attacker to spoof...

python: CRLF injection via the host part of the url passed to urlopen()

A CRLF injection flaw was discovered in python in the way URLs are handled when doing an HTTP/HTTPS connection e.g. through urlopen or HTTPConnection. An attacker who can control the url parameter passed to urlopen method in the urllib/urllib2 modules can inject CRLF sequences and HTTP headers by...

The vulnerability of SCALANCE programmable logic controllers’ microprogramming software is related to insufficient protection of the website structure, allowing attackers to obtain the protected web connection identifiers.

The vulnerability of the microprogrammed programmable logic controller SCALANCE is related to insufficient protection of the website structure. Exploiting this vulnerability could allow an attacker to disclose the protected web connection identifiers from cookie files through a specially crafted...

soci Remote Code Execution Vulnerability

soci is a C++ library for accessing databases. A security vulnerability exists in soci that originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the response and replacing the requested...

Design/Logic Flaw

Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service by deleting the configuration via a wc.dll?wwMaintEditConfig request which reaches an older version of a West Wind Web Connection HTTP service...

NetScaler is forcing the SSL connection on sites browsed with Secure Web

Web Links for HTTP resources attempting to connect via Secure Web over HTTPs and failing as resource does not exist on HTTPs...

UBUNTU-CVE-2016-7098

Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open...

West Wind Web Connection Unprotected Configuration Editor Application

The remote host is running a web application that utilizes the West Wind Web Connection framework. Nessus was able to access the West Wind Web Connection framework configuration file editor without providing credentials. The configuration file editor allows remote configuration of the application...

OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004)

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.227, and 1.3.128 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the...

Microsoft Remote Desktop Connection Remote Code Execution Vulnerability (969706)

This host is missing a critical security update according to Microsoft Bulletin MS09-044. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SYM06-16 Symantec NetBackup PureDisk Remote Office Edition Elevation of Privilege

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Symantec Security Advisory SYM06-015 16 August 2006 Symantec NetBackup PureDisk: Non-Privileged User Authentication Bypass Elevation of Privilege Revision History None Severity Medium highly dependent on network configuration Remote Access Yes Local...

CVE-2004-0006

Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81, allow remote attackers to cause a denial of service and possibly execute arbitrary code via 1 cookies in a Yahoo web connection, 2 a long name parameter in the Yahoo login web page, 3 a long value parameter in the...

CVE-2004-0006

Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81, allow remote attackers to cause a denial of service and possibly execute arbitrary code via 1 cookies in a Yahoo web connection, 2 a long name parameter in the Yahoo login web page, 3 a long value parameter in the...