22215 matches found
CVE-2021-1460: Uncontrolled Resource Consumption
A vulnerability in the Cisco IOx Application Framework of Cisco 809 Industrial Integrated Services Routers Industrial ISRs, Cisco 829 Industrial ISRs, Cisco CGR 1000 Compute Module, and Cisco IC3000 Industrial Compute Gateway could allow an unauthenticated, remote attacker to cause a denial of...
PT-2021-2496
Name of the Vulnerable Software and Affected Versions: Cisco IOx Application Framework affected versions not specified Description: The issue is related to insufficient error handling during packet processing, which could allow an unauthenticated, remote attacker to cause a denial of service DoS...
Code injection
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to ...
Denial of Service in Page Error Handling
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C 5.5 CWE-405, CWE-674 Status: DRAFT Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a...
GHSA-4P9G-QGX9-397P Denial of Service in Page Error Handling
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C 5.5 CWE-405, CWE-674 Status: DRAFT Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a...
File Upload Vulnerability in Ke361
Ke361 is an open source Taobao system. Ke361 suffers from a file upload vulnerability that can be exploited by attackers to gain control of a web server...
Denial of Service in Page Error Handling
Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack...
USN-4848-1 mini-httpd vulnerability
It was discovered that ACME minihttpd did not properly handle HTTP GET requests with empty headers. A remote attacker could use this vulnerability to read arbitrary files...
Command Execution Vulnerability in MCMS
MCMS is a development template based on SpringBoot 2 architecture , front-end based on vue, element ui . MCMS suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the web server...
Command execution vulnerability exists in OneThink (CNVD-2021-22773)
OneThink is an open source content management framework. OneThink suffers from a command execution vulnerability that can be exploited by an attacker to gain control of a web server...
Command Execution Vulnerability in OneThink
OneThink is an open source content management framework. OneThink suffers from a command execution vulnerability that can be exploited by an attacker to gain control of a web server...
File upload vulnerability exists in YZNCMS backend
YZNCMS is a CMS content management system based on the latest TP5.1 framework. YZNCMS has a file upload vulnerability in the backend, which can be exploited by attackers to gain control of the web server...
Rack parse_cookies_header Data Compromise
The vulnerability of the parsecookiesheader function in the utils.rb module of the Rack web server and web application interface is related to the lack of a mechanism for checking input data. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...
rack/directory.rb check_forbidden Confidential Data
The vulnerability of the checkforbidden function in the rack/directory.rb module of the Rack framework, which is used between web servers and web applications, relates to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain...
Track HTTP Server DoS
The vulnerability of the HTTP Server TCP/IP stack in Track involves insufficient validation of input data during packet processing. Exploiting this vulnerability allows an attacker to cause service failures or execute arbitrary code...
Siemens SICAM Integrated Web Server Remote Unauthorized Access
The vulnerability of the configuration of the integrated web-server microprogramming software for Siemens SICAM remote terminals is related to insufficient data protection. Exploiting this vulnerability can allow an intruder operating remotely to gain unauthorized access to protected information...
HTTP Bridge - Send TCP Stream Packets Over Simple HTTP Request
I've wrote this program as a proof of concept to test the idea of be able to send tcp stream packets over simple http request like PUT, PATCH, POST, GET, without use a proxy way like CONNECT method. Also as a practice exercise to train my novice skill on rust language. Description These tool is...
ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1326 more potentially affected by CVE-2020-13959 via org.apache.velocity:velocity-tools (>=2.0-beta3, <=2.0)
org.apache.velocity:velocity-tools MAVEN version =2.0-beta3, =9.1.1, =1.0.0-alpha-2, =1.0.0, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.1.0 and more Source cves: CVE-2020-13959 Source advisory: OSV:GHSA-FH63-4R66-JC7V...
CVE-2020-24984
An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server...
CVE-2020-24984
An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server...