4604 matches found
CVE-2017-7725
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...
PT-2017-9765 · Moxa · Moxa Awk-3131A Wireless Access Point
Name of the Vulnerable Software and Affected Versions: Moxa AWK-3131A Wireless Access Point version 1.1 Description: A null pointer dereference issue exists in the Web Application functionality. Sending an HTTP GET request without a preceding '/' can cause a segmentation fault in the web server. ...
CVE-2016-8723: NULL Pointer Dereference
An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...
CVE-2017-7725: Improper Neutralization of Input During Web Page Generation
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...
Moxa MXview < 2.9 Multiple Vulnerabilities (HTTP) - Active Check
Moxa MXview is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Directory traversal
Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary files via a .. dot dot in a "GET /uir/" request...
PT-2017-8688
Name of the Vulnerable Software and Affected Versions OXID eShop versions prior to 5.1.12, 5.2.9, 4.8.12, and 4.9.9 Description The issue allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Recommendations For versions prior to 5.1.12, update to...
CVE-2016-5072: Improper Control of Generation of Code
OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...
PT-2017-2285
Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus 8.0 for Linux File Servers Description The issue is related to a cross-site scripting vulnerability in the web console of Kaspersky Anti-Virus 8.0 for Linux File Servers. An attacker can exploit this by sending a specially...
PT-2017-2286
Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus 8.0 for Linux File Servers Description The issue is related to a potential command injection vulnerability in the web console of the antivirus software. This could allow a remote attacker to access a file on the server by...
Disk Sorter Enterprise 'GET' Buffer Overflow Vulnerability
Flexense Disk Sorter Enterprise is a file categorization solution from Flexense USA. The solution supports file classification to disk, directory, network share and NAS storage devices and performs advanced historical trending operations. A buffer overflow vulnerability exists in Disk Sorter...
CVE-2017-7230
A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET request...
Buffer overflow
A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET request...
CVE-2017-7230
A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET request...
CVE-2017-7230
A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET request...
CVE-2017-7230: Improper Restriction of Operations within the Bounds of a Memory Buffer
A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET request...
PT-2017-17593
Name of the Vulnerable Software and Affected Versions Disk Sorter Enterprise versions 9.5.12 and earlier Description A buffer overflow issue allows remote attackers to execute arbitrary code via a GET request. Recommendations For Disk Sorter Enterprise versions 9.5.12 and earlier, at the moment,...
AXIS Communications - Cross-Site Scripting / Content Injection
0RWELLL4BS security advisory olsa-2015-8258 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: ImagePath Resource Injection/Open script editor - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Improper Input Validation CWE-20 - CVE Name:...
CVE-2017-6061
Cross-site scripting XSS vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arbitrary web script or HTML via a GET request. /finance/help/en/frameset.htm is the URI for this component. The vendor response is SAP Securit...
Cross site scripting
Cross-site scripting XSS vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arbitrary web script or HTML via a GET request. /finance/help/en/frameset.htm is the URI for this component. The vendor response is SAP Securit...