CVE-2018-20355

An invalid write of 8 bytes due to a use-after-free vulnerability in the mghttpfreeprotodatacgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service application crash or remote code execution...

CVE-2018-20354

The CVE-2018-20354 issue affects Cesanta Mongoose Embedded Web Server Library (versions 6.13 and earlier). A use-after-free in mg_http_get_proto_data during a return causes an invalid read of 8 bytes, leading to denial of service (crash) or remote code execution. NVD data shows high/critical impa...

CVE-2018-20353

The CVE affects Cesanta Mongoose Embedded Web Server Library, versions 6.13 and earlier, where a use-after-free causes an invalid read of 8 bytes in mg_http_get_proto_data. This vulnerability can lead to a denial of service (application crash) or remote code execution. No exploitation details are...

CVE-2018-20352

Use-after-free vulnerability in the mgcgievhandler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service application crash or remote code execution...

Lexmark Printer Shortcut Integrity Vulnerability (CVE-2019-6489)

Certain Lexmark CX, MX, X, XC, XM, XS, and 6500e devices allow remote attackers to erase stored shortcuts. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Schneider Electric Modicon M340, Premium, Quantum PLC and BMXNOR0200 Information Disclosure Vulnerability

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. An information disclosure vulnerability exists in the embedded web server in the Modicon M340, Premium, Quantum PLC, and BMXNOR0200, which can be exploited by an attacker to obtain...

CVE-2018-7804

A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing...

CVE-2018-7810

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...

CVE-2018-7810

CVE-2018-7810 is an XSS vulnerability in the embedded web servers of Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is improper neutralization of input during web page generation, allowing an attacker to craft a URL containing JavaScript that will be execute...

Denial of Service Vulnerability in Multiple Schneider Electric Products (CNVD-2018-24634)

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. A denial of service vulnerability exists in the embedded web server in several Schneider Electric products, which can be exploited by an attacker to cause a denial of service by sending ...

Cross-site scripting vulnerability in multiple Schneider Electric products (CNVD-2018-25427)

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. A cross-site scripting vulnerability exists in the embedded web server in several Schneider Electric products, which can be exploited by remote attackers to change passwords on the web...

The vulnerability of the embedded web-server software module of the APC MGE SNMP/Web Card Transverse 66074 power supply failure management system allows a hacker to gain full control over the device.

The vulnerability of the embedded web-server-based microprogramming software module for managing uninterruptible power supplies, the APC MGE SNMP/Web Card Transverse 66074, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass...

Unspecified vulnerability in mongose

mongose is an embedded web server. A security vulnerability exists in mongose. An attacker can exploit this vulnerability to steal environment variables...

The vulnerability of the embedded web-server software module of the APC MGE SNMP/Web Card Transverse 66074 allows a intruder to modify the device’s settings.

The vulnerability of the embedded web-server-based microprogramming software module for managing uninterruptible power supplies, the APC MGE SNMP/Web Card Transverse 66074, is caused by authentication errors. Exploiting this vulnerability could allow a malicious actor to remotely alter device...

ABB Fox515T embedded Web server local file inclusion vulnerability

ABB Fox515T is a multifunctional optical transmission device from ABB Switzerland. embedded web server is one of the embedded web servers. A local file inclusion vulnerability exists in the embedded web server of the ABB Fox515T version 1.0. A remote attacker can exploit this vulnerability to...

CVE-2017-15583

The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. It accepts a parameter that specifies a file for display or for use as a template. The filename is not validated; an attacker could retrieve any file...

CVE-2017-15583

ABB Fox515T 1.0 embeds a web server that is vulnerable to Local File Inclusion through an unvalidated filename parameter, allowing a remote attacker to retrieve arbitrary files. This vulnerability is documented across multiple sources (e.g., CVE-2017-15583, Tenable plugin, CNVD, CNVD-2017-33793, ...

PT-2017-14114 · Abb · Abb Fox515T

Name of the Vulnerable Software and Affected Versions: ABB Fox515T version 1.0 Description: The embedded web server is vulnerable to Local File Inclusion. It accepts a parameter that specifies a file for display or for use as a template. The filename is not validated, allowing an attacker to...

VulnCheck KEV: CVE-2016-10176

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server uhttpd and processed accordingly. The web server also contains another URL, applynoauth.cgi,...

GoAhead Denial of Service Vulnerability

GoAhead is the United States Embedthis company a small embedded Web server , it supports embedded in a variety of devices and applications . A denial of service vulnerability exists in the 'websDecodeUrl' function of the http.c file in GoAhead versions 3.4.0 through 3.6.5. An attacker can exploit...