HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

The vulnerability of the microprogrammed software in PTZOptics PT30X-SDI/NDI webcams lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a perpetrator to execute arbitrary code.

The vulnerability of the microprogrammed webcam PTZOptics PT30X-SDI/NDI lies in the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially...

CVE-2024-50999

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51132

CVE-2024-51132 describes an XML External Entity (XXE) vulnerability in HAPI FHIR prior to v6.4.0. The root cause is XXE in FHIR parsing (org.hl7.fhir.core) that can allow an attacker to read sensitive information or potentially execute arbitrary code via a crafted XML request. Affected components...

CVE-2024-50999

Netgear R8500, v1.0.2.160, is affected by a command-injection vulnerability in the sysNewPasswd parameter of password.cgi. The issue allows an attacker to execute arbitrary OS commands via a crafted request. Public documentation consistently references Netgear R8500 v1.0.2.160 and the sysNewPassw...

The vulnerability of the formSetDomainFilter() function (/goform/formSetDomainFilter) in the D-Link DIR-605L router software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetDomainFilter function /goform/formSetDomainFilter of the D-Link DIR-605L router’s microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the...

LevelOne WBR-6012 安全漏洞

The LevelOne WBR-6012 is a wireless router from LevelOne. A security vulnerability exists in the LevelOne WBR-6012 that originates from the effects of resource misallocation in a web application and can cause network service interruption via a specially crafted request...

Security Bulletin: IBM Master Data Management is vulnerable to denial of service through OpenSSL by a specially crafted request (CVE-2023-2650)

Summary IBM Master Data Management v11.6, and v12.0 are vulnerable to denial of service through OpenSSL by a specially crafted request from no message size limit. OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt directly, or use any of the OpenSSL subsystems...

GHSA-762V-RQ7Q-FF97 Mattermost Server vulnerable to application crash from attacker-generated large response

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1 and 9.5.x = 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by...

CVE-2024-47401

CVE-2024-47401 affects Mattermost Playbooks in versions 9.10.x up to 9.10.2, 9.11.x up to 9.11.1, and 9.5.x up to 9.5.9. The issue arises because the product does not prevent detailed error messages from being displayed, enabling an attacker to generate a large response and trigger an amplified G...

CVE-2024-47401 DoS via Amplified GraphQL Response in Playbooks

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1 and 9.5.x = 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by...

CVE-2024-47401 DoS via Amplified GraphQL Response in Playbooks

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1 and 9.5.x = 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by...

The vulnerability of the iCMS content management system, related to the manipulation of cross-site requests, allows a hacker to perform a CSRF attack.

The vulnerability of the iCMS content management system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using a specially created HTTP request...

The vulnerability of the formSetWAN_Wizard51() and formSetWAN_Wizard52() functions in the D-Link DIR-605L router software allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetWANWizard51 and formSetWANWizard52 functions in the D-Link DIR-605L router’s microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the...

Fortinet FortiWeb ] Stack-Based Buffer Overflow vulnerability using a crafted request (FG-IR-20-125)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-125 advisory. - A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an...

BIT-GRAFANA-2023-5122 SSRF in CSV Datasource Plugin

Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests t...