CVE-2021-20647

CVE-2021-20647 is a CSRF vulnerability in ELECOM WRC-300FEBK-S. The issue allows remote attackers to hijack administrator authentication and issue arbitrary requests, potentially changing device settings or starting a telnet daemon via an unspecified vector. Product: ELECOM WRC-300FEBK-S. Impact ...

CVE-2021-20646

CVE-2021-20646 affects ELECOM WRC-300FEBK-A and is a Cross-site Request Forgery (CSRF) vulnerability that can hijack an administrator’s session and cause arbitrary requests to be executed, potentially altering device settings or starting a telnet daemon. The connected documents confirm the vulner...

Open-Xchange: Blind XXE via Powerpoint files

Summary During the parsing of Powerpoint files it seems that it is possible to include XXE payload which will be executed on the Open-XChange server. I was able to identify which files exist on the server, and cause the server make arbitrary request to my own server, and I am pretty sure it is al...

Microsoft Edge Fetch API allows setting of arbitrary request headers (CVE-2017-0140)

Introduction The Fetch API provides an interface for fetching resources including across the network. It will seem familiar to anyone who has used XMLHttpRequest, but the Fetch API provides a more powerful and flexible feature set. Starting in EdgeHTML 14, which ships with Windows 10 Anniversary...

Design/Logic Flaw

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...