CVE-2022-25752

CVE-2022-25752 relates to Siemens SCALANCE X-300/XR324 series devices where the webserver counts and uses session IDs/nonces insecurely. This design flaw could let an unauthenticated remote attacker brute‑force session IDs and hijack existing sessions, potentially affecting a wide range of SCALAN...

PT-2022-3540 · Siemens · Scalance X310 +14

Name of the Vulnerable Software and Affected Versions: SCALANCE X302-7 EEC 230V SCALANCE X302-7 EEC 230V, coated SCALANCE X302-7 EEC 24V SCALANCE X302-7 EEC 24V, coated SCALANCE X302-7 EEC 2x 230V SCALANCE X302-7 EEC 2x 230V, coated SCALANCE X302-7 EEC 2x 24V SCALANCE X302-7 EEC 2x 24V, coated...

CVE-2022-24423

Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulting in a denial of service condition...

CVE-2022-22519

A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system...

CVE-2022-22519

A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system...

Design/Logic Flaw

A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system...

CVE-2022-22519 Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system.

A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system...

CVE-2022-22519

The CVE-2022-22519 entry describes a remote, unauthenticated attacker able to send crafted HTTP/HTTPS requests that trigger a buffer over-read, crashing the CODESYS Control runtime system webserver. This affects the CODESYS Control runtime/webserver and related components; CVSSv3.1 base score 7.5...

CVE-2021-43430

An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via imwebserver, which could let a malicious user upload PHP Trojan files...

CVE-2021-43205

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries...

Xxe

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries...

CVE-2022-22519

A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system...

CVE-2021-43205

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries...

FortiClient (Linux) - external access to confighandler webserver

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiClient for Linux may allow an unauthenticated attacker to access the confighandler webserver via external binaries...

Cross-site Scripting (XSS)

libkiwix.so is vulnerable to cross-site scriptingXSS attacks. The library does not properly escape the searchURL parameter in the built-in webserver functionality, which allows an attacker to inject and execute malicious code...

CVE-2022-27920

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

CVE-2022-27920

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

CVE-2022-27920

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

DEBIAN-CVE-2022-27920

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

CVE-2022-27920

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...