5791 matches found
Information Exposure
apache-airflow is vulnerable to Information Exposure. The vulnerability is due a flaw in the "configuration" UI page when "non-sensitive-only" was set as webserver.exposeconfig configuration. An attacker can exploit this vulnerability by sending a specially crafted request to see sensitive provid...
[SECURITY] Fedora 38 Update: python-aiohttp-3.9.3-3.fc38
Python HTTP client/server for asyncio which supports both the client and the server side of the HTTP protocol, client and server websocket, and webservers with middlewares and pluggable routing...
[SECURITY] Fedora 39 Update: python-aiohttp-3.9.3-3.fc39
Python HTTP client/server for asyncio which supports both the client and the server side of the HTTP protocol, client and server websocket, and webservers with middlewares and pluggable routing...
[SECURITY] Fedora 40 Update: python-aiohttp-3.9.3-3.fc40
Python HTTP client/server for asyncio which supports both the client and the server side of the HTTP protocol, client and server websocket, and webservers with middlewares and pluggable routing...
CVE-2024-31869
The CVE affects Apache Airflow 2.7.0–2.8.4, where an authenticated user can view sensitive provider configuration on the configuration UI if webserver.expose_config is set to non-sensitive-only; the Celery provider is noted as having sensitive configurations. Impact is information disclosure via ...
CVE-2024-31869 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.exposeconfig" configuration The celery provider is the only community provider...
CVE-2024-31869 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.exposeconfig" configuration The celery provider is the only community provider...
Schneider Electric Modicon M340 GoAhead Webserver Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2015-7937)
Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data. This plugin only works with Tenable.ot. Please visit...
CVE-2024-27575
INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as with the /cgi-bin/display?file=/etc/passwd URI...
CVE-2023-25200
An HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render malicious HTML and obtain sensitive information in a victim's browser...
CVE-2023-25199
A reflected cross-site scripting XSS vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to execute JavaScript code and obtain sensitive information in a victim's browser...
INOTEC Sicherheitstechnik WebServer CPS220/64 安全漏洞
INOTEC Sicherheitstechnik WebServer CPS220/64 is a centralized battery system from INOTEC Sicherheitstechnik, Germany. A security vulnerability exists in INOTEC Sicherheitstechnik WebServer CPS220/64 version V.3.3.19, which originates from a vulnerability that allows remote attackers to execute...
CVE-2024-27575: Improper Limitation of a Pathname to a Restricted Directory
INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as with the /cgi-bin/display?file=/etc/passwd URI...
PT-2024-21957 · Inotec Sicherheitstechnik · Inotec Sicherheitstechnik Webserver Cps220/64
Name of the Vulnerable Software and Affected Versions: INOTEC Sicherheitstechnik WebServer CPS220/64 version 3.3.19 Description: The issue allows a remote attacker to read arbitrary files via absolute path traversal. For example, using the "/cgi-bin/display?file=/etc/passwd" URI, an attacker can...
CVE-2023-25200
An HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render malicious HTML and obtain sensitive information in a victim's browser...
CVE-2023-25200
An HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render malicious HTML and obtain sensitive information in a victim's browser...
CVE-2023-25200
The MT Safeline X-Ray X3310 webserver, specifically version NXG 19.05 , is affected by an HTML injection vulnerability. This flaw allows a remote attacker to render malicious HTML within a victim's browser, which can be used to obtain sensitive information . Additionally, related reports indicate...
CVE-2024-27575
The INOTEC Sicherheitstechnik WebServer CPS220/64 version 3.3.19 is vulnerable to an absolute path traversal flaw. A remote attacker can exploit this by using specific URIs, such as /cgi-bin/display?file=/etc/passwd, to read arbitrary files on the system. While the primary impact is unauthorized ...
CVE-2023-25200: Improper Neutralization of Input During Web Page Generation
An HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render malicious HTML and obtain sensitive information in a victim's browser...