XAPI open file limit DoS

ISSUE DESCRIPTION It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors...

PT-2022-5004 · Hitachi Energy · Hitachi Energy Msm

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MSM versions V2.2 and prior Description: A vulnerability exists in the HTTP web interface where it does not validate data in an HTTP header, leading to a possible HTTP response splitting. This could allow an attacker to channel...

io.undertow:undertow-servlet (1.1.0.beta3), io.undertow:undertow-websockets-jsr (1.1.0.beta3) +1 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.1.0.beta3)

io.undertow:undertow-core MAVEN version 1.1.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.beta3 - io.undertow:undertow-websockets-jsr 1.1.0.beta3 -...

io.undertow:undertow-http2-test-suite (1.2.0.beta5), io.undertow:undertow-servlet (1.2.0.beta5) +2 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.0.beta5)

io.undertow:undertow-core MAVEN version 1.2.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta5 - io.undertow:undertow-servlet 1.2.0.beta5 -...

io.undertow:undertow-servlet (1.1.0.beta6), io.undertow:undertow-websockets-jsr (1.1.0.beta6) +1 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.1.0.beta6)

io.undertow:undertow-core MAVEN version 1.1.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.beta6 - io.undertow:undertow-websockets-jsr 1.1.0.beta6 -...

io.undertow:undertow-servlet (1.0.5.final), io.undertow:undertow-websockets-jsr (1.0.5.final) +1 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.0.5.final)

io.undertow:undertow-core MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.5.final - io.undertow:undertow-websockets-jsr 1.0.5.final -...

com.github.zurekp:slb (>=0.0.1, <=0.0.4), io.undertow:undertow-http2-test-suite (1.2.0.beta6) +3 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.0.beta6)

io.undertow:undertow-core MAVEN version 1.2.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.zurekp:slb =0.0.1, =1.0.0.alpha14, =1.0.0.alpha15 Source cves: CVE-2020-1745 Source advisory...

co.paralleluniverse:comsat-test-utils (0.2.0), io.undertow:undertow-servlet (1.1.0.beta5) +2 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.1.0.beta5)

io.undertow:undertow-core MAVEN version 1.1.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-test-utils 0.2.0 - io.undertow:undertow-servlet 1.1.0.beta5 -...

io.undertow:undertow-http2-test-suite (1.2.0.beta1), io.undertow:undertow-servlet (1.2.0.beta1) +2 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.0.beta1)

io.undertow:undertow-core MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta1 - io.undertow:undertow-servlet 1.2.0.beta1 -...

com.mpay24.payment:mpay24-payment-sdk (1.0.0.0), com.mpay24.payment:mpay24-soap-base (1.0.0.0) +11 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.0.10.final)

io.undertow:undertow-core MAVEN version 1.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.mpay24.payment:mpay24-payment-sdk 1.0.0.0 - com.mpay24.payment:mpay24-soap-base 1.0.0.0 -...

io.undertow:undertow-http2-test-suite (1.2.0.beta2), io.undertow:undertow-servlet (1.2.0.beta2) +2 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.2.0.beta2)

io.undertow:undertow-core MAVEN version 1.2.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta2 - io.undertow:undertow-servlet 1.2.0.beta2 -...

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

CVE-2022-30525 by 1vere$k Rapid7 discovered and reported a...

CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection

Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning ZTP, which includes the ATP series, VPN series, and the USG FLEX series including USG20-VPN and USG20W-VPN. The vulnerability, identified as CVE-2022-30525, allows an unauthenticated and...

CVE-2022-26251

The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges...

Code injection

The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges...

CVE-2022-26251

CVE-2022-26251 affects SynaMan v5.1 and earlier. The HTTP interface is vulnerable to authenticated code execution and privilege escalation. Root cause/details are not explicitly described in the provided sources; no remediation steps are listed here. If available, patch/version info should be con...

CVE-2022-26251

The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges...

CVE-2022-26251: Improper Privilege Management

The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges...

Synametrics Technologies SynaMan 安全漏洞

Synametrics Technologies SynaMan is a remote file manager from Synametrics Technologies. A security vulnerability exists in Synametrics Technologies SynaMan v5.1 and below, which can be exploited by an authenticated attacker to execute arbitrary code and elevate privileges via the HTTP interface...

pfSense 2.5.2 Shell Upload Exploit

This Metasploit module exploits an arbitrary file creation vulnerability in the pfSense HTTP interface CVE-2021-41282. The vulnerability affects versions 2.5.2 and below and can be exploited by an authenticated user if they have the "WebCfg - Diagnostics: Routing tables" privilege. This module us...