Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

HangZhou XiongMai Technologies Net Surveillance Detection (HTTP)

HTTP based detection of HangZhou XiongMai Technologies Net Surveillance. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2018-16329

Name of the Vulnerable Software and Affected Versions Sony IPELA E Series Network Camera G5 firmware 1.87.00 Description A command injection issue exists in the measurementBitrateExec functionality, allowing arbitrary commands to be executed with a specially crafted GET request. This can be...

CVE-2017-14446

An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this...

CVE-2017-14446: Out-of-bounds Write

An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this...

Northern Electric & Power (NEP) Inverter Monitor Detection

This script sends an HTTP GET request to figure out whether an NEP Inverter monitor is running on the target host and which version is installed. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2018-7787

In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request...

CVE-2018-7787

In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request...

CVE-2018-7787

In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request...

PT-2018-18283

Name of the Vulnerable Software and Affected Versions: Schneider Electric U.motion Builder versions prior to 1.3.4 Description: The issue is caused by improper validation of input of the context parameter in an HTTP GET request. Recommendations: For versions prior to 1.3.4, update to version 1.3....

CVE-2018-1000195

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

Server side request forgery (ssrf)

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

CVE-2018-1000195

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

CVE-2018-1000195: Cross-Site Request Forgery (CSRF)

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

CVE-2018-7506

CVE-2018-7506 affects Moxa MXview 2.8 and earlier, where the web server private key can be read via HTTP GET, enabling information disclosure and potential decryption of encrypted data. Public sources confirm this is an information exposure vulnerability; Moxa released MXview 2.9 as a fix. No exp...

CVE-2018-7506

The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attacker to decrypt encrypted information...

The vulnerability in the web server of the SyncBreeze file synchronization software, the DupScout file duplication detection software, the DiskSavvy disk space analyzer, and the DiskPulse logical disk change monitoring software allows a malicious actor to gain access to the system with NT AUTHORITY/SYSTEM privileges.

The vulnerability of the web server software for synchronizing SyncBreeze files, the software for detecting file duplicates DupScout, the disk space analyzer DiskSavvy, and the software for monitoring changes on hard drives DiskPulse is caused by buffer overflows. Exploiting this vulnerability ca...

Lutron Quantum BACnet Integration Devices Information Disclosure Vulnerability

Lutron Quantum BACnet Integration device is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Geovision Inc. IP Camera Remote Detection

Detection of running version of Geovision Inc. IP Camera. This script sends an HTTP GET request and tries to ensure the presence of Geovision Inc. IP Camera. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

D-Link DSL-2640U and DSL-2540U Remote Code Execution Vulnerability

The D-Link DSL-2640U and DSL-2540U are both router products from AUO D-Link. A remote code execution vulnerability exists in the diagping.cmd file in D-Link DSL-2640U devices with firmware versions IM1.00 and ME1.00 and DSL-2540U devices with firmware version ME1.00. A remote attacker can exploit...