Reactor Netty Security Vulnerability

Reactor Netty is a non-blocking and backpressure-ready TCP/HTTP/UDP/QUIC client and server based on the Netty framework. A security vulnerability exists in Reactor Netty that originates in the HTTP Server that allows an attacker to cause a denial of service DOS via a specially crafted HTTP reques...

USN-6510-1 apache2 vulnerability

David Shoon discovered that the Apache HTTP Server modmacro module incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service...

CVE-2023-3104

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication...

Authentication flaw

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication...

CVE-2023-3104 Missing Authentication for Critical Function in Unitree Robotics A1

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication...

CVE-2023-3104

The CVE-2023-3104 issue relates to Unitree Robotics A1 cameras, described as a lack of authentication that allows an unauthenticated local user to view through the cameras via the web server. The connected records corroborate a basic authentication bypass affecting the device’s web interface, wit...

PT-2023-23118 · Unitreerobotics +1 · A1 +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue is related to a lack of authentication, allowing an unauthenticated local user to access cameras through the web server without any form of authentication. Recommendations...

Unitree Robotics A1 Security Breach

Unitree Robotics A1 is a quadrupedal robot from Chinese company Unitree Robotics. A security vulnerability exists in Unitree Robotics A1 version 1.16, which stems from a lack of authentication and allows a local attacker to use a web server to view through a webcam...

CVE-2023-3104: Missing Authentication for Critical Function

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication...

SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_jk (SUSE-SU-2023:4513-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4513-1 advisory. - The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in...

PT-2023-7597 · NetGear · Netgear Orbi Rbr750

Name of the Vulnerable Software and Affected Versions: Netgear Orbi RBR750 versions prior to V7.2.6.21 Description: The issue is related to a stack-based buffer overflow in the /usr/sbin/httpd process. It is also associated with the strlcpy function, which can cause a buffer overflow when handlin...

Remote Code Execution due to Full Controled File Write in mlflow

The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution like overwriting /home//.bashrc. ...

Remote code execution

An attacker is able to steal secrets and potentially gain remote code execution via CSRF using the open source Prefect web server's API...

CVE-2023-6022

CVE-2023-6022 describes a Cross-Site Request Forgery (CSRF) vulnerability in the open-source Prefect project (prefecthq/prefect) affecting versions prior to 2.16.5. The CVSS base score is 8.8 (High) with impacts to confidentiality, integrity, and availability. Related sources indicate the issue c...

Directory Traversal in Reactor Netty HTTP Server

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

VulnCheck KEV: CVE-2001-0537

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL...

ManageEngine SupportCenter Plus < 14.0 Build 14000

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.0 Build 14000. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-23076 advisory. - OS Command injection vulnerability in Support Center Plus 11 via Executor in Action...

ManageEngine SupportCenter Plus < 14.2 Build 14200

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.2 Build 14200. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-38331 advisory. - Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS i...

The vulnerability of the web server of Delta Electronics’ DX-3021L9 microprogrammed router software arises from insufficient validation of input data. This allows attackers to add, modify, or delete data.

The vulnerability of the web server of the microprogrammed routing software from Delta Electronics DX-3021L9 exists due to insufficient verification of input data. Exploiting this vulnerability can allow a remote attacker to add, modify, or delete data...

Micrium uC-HTTP Security Vulnerability

Micrium uC-HTTP is a software from Micrium USA that provides TCP/IP functionality for devices. The software is designed for embedded applications with a compact, reliable, high-performance TCP/IP stack with dual support for IPv4 and IPv6. A security vulnerability exists in Micrium uC-HTTP version...