293 matches found
Cross site request forgery (csrf)
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘firmfilter’ parameter...
Design/Logic Flaw
Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...
CVE-2021-21877
Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...
PT-2021-14825 · Lantronix · Lantronix Premierwave 2050
Name of the Vulnerable Software and Affected Versions: Lantronix PremierWave 2050 version 8.9.0.0R4 Description: A directory traversal issue exists in the Web Manager FsTFtp functionality, allowing a specially crafted HTTP request to potentially overwrite FsTFtp files. This can be triggered by an...
PT-2021-7545 · Hirschmann · Hirschmann Bat-C2
Name of the Vulnerable Software and Affected Versions: Hirschmann BAT-C2 affected versions not specified Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This can be exploited by sending specially crafted HTTP requests,...
PT-2021-9655 · Unknown · Rukovoditel Project Management App
Name of the Vulnerable Software and Affected Versions: Rukovoditel Project Management App version 2.7.2 Description: The issue is related to an exploitable SQL injection vulnerability in the 'entities/fields' page. Specifically, the entities id parameter in this page is vulnerable when using the...
CVE-2021-36702
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through...
PT-2021-9657 · Unknown · Rukovoditel Project Management App
Name of the Vulnerable Software and Affected Versions: Rukovoditel Project Management App version 2.7.2 Description: An exploitable SQL injection issue exists in the "global lists/choices" page. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP...
Rukovoditel SQL注入漏洞
Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...
Advantech WebAccess/SCADA 路径遍历漏洞
Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A local file inclusion vulnerability...
CVE-2021-26905
1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...
Design/Logic Flaw
1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...
CVE-2021-26905
1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...
CVE-2020-9301
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container...
PT-2020-18917 · Wago · Wago Pfc 200
Name of the Vulnerable Software and Affected Versions: WAGO PFC 200 version 03.03.1015 Description: A code execution issue exists in the Web-Based Management functionality, allowing remote code execution through specially crafted HTTP requests. An attacker can trigger this issue by making an...
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
A flaw was found in the Node.js code where a specially crafted HTTPs request sent to a Node.js server failed to properly process the HTTPs headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is...
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
A flaw was found in the Node.js code where a specially crafted HTTPs request sent to a Node.js server failed to properly process the HTTPs headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is...
Command injection
An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...
CVE-2019-5142
An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...
Cisco TelePresence Advanced Media Gateway Denial of Service Vulnerability
Cisco TelePresence Advanced Media Gateway is a high-definition multimedia gateway device from Cisco USA. A security vulnerability exists in the web application in Cisco TelePresence Advanced Media Gateway, which stems from a lack of input validation in the program. A remote attacker could exploit...