A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

...

The vulnerability of the web-based service interfaces of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to induce service failures.

The vulnerability of the web-service interfaces of Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger a service failure through a specially...

The vulnerability of the web-service interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to enhance their privileges.

The vulnerability of the web-service interfaces of Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to the improper assignment of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges through a specially...

The vulnerability of the Grafana data processing web tool lies in its ability to bypass authentication procedures, allowing attackers to elevate their privileges by sending specially crafted HTTP requests.

The vulnerability of the Grafana data processing web tool is related to the possibility of bypassing the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending a specially crafted HTTP request...

Vapor 安全漏洞

Vapor is a Swift web development framework. Can be used to develop high-performance Web applications , support for iOS, OS X and Ubuntu systems. A denial-of-service vulnerability exists in Vapor versions prior to 4.61.1 that stems from not properly handling incoming error messages and can be...

Cisco Adaptive Security Appliance Software Remote Access SSL VPN DoS (cisco-sa-asa-dos-tL4uA4AA)

A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper validation of errors that are logged as a...

CVE-2022-30425

Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerability is exploited via a crafted POST request...

The vulnerability of the TrueConf Server software lies in the lack of authentication for a critical function, which allows a perpetrator to trigger a service failure.

The vulnerability of the TrueConf Server software is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a perpetrator to remotely cause service failures by sending specially crafted requests...

CVE-2022-26833

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

CVE-2022-26303

An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can send a sequence of requests to trigge...

CVE-2022-26043

An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attacker can send a sequence of requests t...

PYSEC-2022-203

DISPUTED Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported...

Open Automation Software OAS Platform 访问控制错误漏洞

Open Automation Software OAS Platform is an industrial Internet of Things IoT suite from Open Automation Software, Inc. Open Automation Software OAS Platform V16.00.0112 is vulnerable to an access control error that could be exploited to create OAS user accounts with specially crafted network...

CVE-2022-26833

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS which allows an attacker to deny access to all users via crafted requests to the apollouploadserver middleware. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible...

SuiteCRM authenticated SQL injection in export functionality

This module exploits an authenticated SQL injection in SuiteCRM in versions before 7.12.6. The vulnerability allows an authenticated attacker to send specially crafted requests to the export entry point of the application in order to retrieve all the usernames and their associated password from t...

CVE-2022-20802

A vulnerability in the web interface of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by...

TotoLink A3100R 安全漏洞

TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R versions V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to an access control error, which could be exploited by attackers to to obtain sensitive information via a crafted web request...

The vulnerability of the implementation of the VPN Secure Sockets Layer (SSL) function in microprogramming-based network interface controllers of Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows a attacker to cause service interruptions.

The vulnerability of the implementation of the VPN Secure Sockets Layer SSL function in microprogramming-based network interface controllers from Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to resource management errors. Exploiting this vulnerability c...

.NET Core Denial of Service Vulnerability

.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability"...