516 matches found
Stack overflow
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by...
CVE-2020-1631 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...
CVE-2020-6224
SAP NetWeaver AS Java HTTP Service, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure...
CVE-2020-6224
SAP NetWeaver AS Java HTTP Service, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure...
CVE-2020-6224
CVE-2020-6224 affects SAP NetWeaver AS Java (HTTP Service). Affected versions are 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. The vulnerability allows an attacker with administrator privileges to access user credentials (e.g., passwords) stored in trace files when a user logs in and sends login...
Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution Exploit
This Metasploit module exploits an authenticated command injection vulnerability in the v-list-user-backups bash script file in Vesta Control Panel to gain remote code execution as the root user. This module requires Metasploit: https://metasploit.com/download Current source:...
CVE-2020-6224: Insertion of Sensitive Information into Log File
SAP NetWeaver AS Java HTTP Service, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure...
PT-2020-19022
Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java HTTP Service versions 7.10 through 7.50 Description The issue allows an attacker with administrator privileges to access user sensitive data, such as passwords, in trace files when a user logs in and sends a request with...
Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Vesta Control Panel Authenticated Remote Code Execution", 'Description' = %q This module exploits command injection vulnerability in...
Vesta Control Panel Authenticated Remote Code Execution
This module exploits an authenticated command injection vulnerability in the v-list-user-backups bash script file in Vesta Control Panel to gain remote code execution as the root user. Module Options msf use exploit/linux/http/vestacp/exec msf undefinedexec show actions ...actions... msf...
CVE-2019-19943
The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parameter. It may be possible to achieve remote code execution because of a double free...
Double free
The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parameter. It may be possible to achieve remote code execution because of a double free...
CVE-2019-19943
The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parameter. It may be possible to achieve remote code execution because of a double free...
CVE-2019-19943
CVE-2019-19943 affects Pablo Quick n Easy Web Server (quickweb.exe) v3.3.8. The HTTP service is vulnerable to remote unauthenticated heap memory corruption when handling a large host or domain parameter, with a double free cited as the underlying cause. This can lead to remote code execution per...
PT-2020-10301
Name of the Vulnerable Software and Affected Versions Pablo Quick 'n Easy Web Server version 3.3.8 Description The issue concerns a Remote Unauthenticated Heap Memory Corruption in the HTTP service of the affected software. This corruption can occur via a large host or domain parameter. It is...
CVE-2019-18339: Missing Authentication for Critical Function
A vulnerability has been identified in SiNVR/SiVMS Video Server All versions V5.0.0. The HTTP service default port 5401/tcp of the SiVMS/SiNVR Video Server contains an authentication bypass vulnerability, even when properly configured with enforced authentication. A remote attacker with network...
Cisco IOS XE HTTP Server Denial of Service Vulnerability
Cisco IOS XE is a set of operating systems developed by Cisco for its network devices. A denial of service vulnerability exists in the HTTP server code of Cisco IOS XE. The vulnerability stems from a logic error in the logging mechanism. An attacker could exploit this vulnerability to cause the...
CVE-2019-5504
ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...
Design/Logic Flaw
ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...