CVE-2020-25194: Improper Privilege Management

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges...

CVE-2020-27397: Unrestricted Upload of File with Dangerous Type

Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution RCE on the Hosting web server via uploading a maliciously crafted PHP file...

PT-2020-16009

Name of the Vulnerable Software and Affected Versions MOXA NPort IAW5000A-I/O firmware versions 2.1 or lower Description The issue concerns improper privilege management in the built-in WEB server, potentially allowing an attacker with user privileges to perform requests with administrative...

PT-2020-16008

Name of the Vulnerable Software and Affected Versions MOXA NPort IAW5000A-I/O versions 2.1 and earlier Description The issue allows sensitive information to be displayed without proper authorization due to the built-in WEB server in MOXA NPort IAW5000A-I/O. Recommendations For MOXA NPort...

CVE-2020-25066

A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service crash/reset or to possibly execute arbitrary code...

File Upload Vulnerability in Situ CMS

Situ CMS is the short name of Situ Tourism Website Management System, which is a self-developed website management system applicable to the construction of tourism websites. A file upload vulnerability exists in SITO CMS. An attacker can exploit this vulnerability to gain control of the web serve...

Undertow Uncontrolled Resource Consumption DoS

The vulnerability of the Undertow web server is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Cisco IOS XE Authentication Bypass

The vulnerability of the Cisco IOS XE operating system’s server authentication function is related to errors in processing input data. Exploiting this vulnerability can allow a remote attacker to cause malfunctions in the server...

Treck TCP/IP Buffer Error Vulnerability

Treck TCP/IP is a TCP Transmission Control Protocol/IP Internet Interconnection Protocol suite from Treck, Inc. dedicated to embedded systems. A security vulnerability exists in Treck TCP/IP stack version 6.0.1.67 and prior versions, which stems from a vulnerability in the Treck HTTP server...

golang: data race in certain net/http servers including ReverseProxy can lead to DoS

A flaw was found Go's net/http package. Servers using ReverseProxy from net/http in the Go standard library are vulnerable to a data race that results in a denial of service. The highest threat from this vulnerability is to system availability...

CVE-2020-25195

The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device...

Input validation

The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device...

CVE-2020-25195

CVE-2020-25195 affects Host Engineering ECOM100 modules (H0-ECOM100, H2-ECOM100, H4-ECOM100). The vulnerability arises because input field length checks are enforced only on the client side when inputs come from the configuration web server, allowing an attacker to bypass the check and send input...

Moderate: Red Hat Security Advisory: nginx:1.16 security update

An update for the nginx:1.16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PT-2020-16010

Name of the Vulnerable Software and Affected Versions Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules affected versions not specified Description The issue arises because the length of input fields in the affected modules is verified only on the client side when receiving input fr...

PT-2020-6288 · NetGear · Netgear Dgn2200V1

Name of the Vulnerable Software and Affected Versions: NETGEAR DGN2200v1 devices version 1.0.0.59 and earlier Description: The issue is related to the mishandling of HTTPd authentication in the NETGEAR DGN2200v1 devices, which can be exploited by a remote attacker to execute arbitrary code. This ...

D-Link Multiple Routers dhttpd Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by...

CVE-2020-28396

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...

CVE-2020-28396

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...

CVE-2020-15796

A vulnerability has been identified in SIMATIC ET 200SP Open Controller incl. SIPLUS variants V20.8, SIMATIC S7-1500 Software Controller V20.8. The web server of the affected products contains a vulnerability that could allow a remote attacker to trigger a denial-of-service condition by sending a...