Reolink RLC-410W cgiserver.cgi Upgrade API denial of service vulnerability

Summary A denial of service vulnerability exists in the cgiserver.cgi Upgrade API functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Reolink RLC-410W...

Reolink Rlc-410W 输入验证错误漏洞

Reolink Rlc-410W is a Wifi security camera from Reolink China. The Reolink Rlc-410W suffers from a denial of service vulnerability that can be exploited by an attacker to cause a reboot via a compiled HTTP request...

llhttp: HTTP Request Smuggling when parsing the body of chunked requests

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...

llhttp: HTTP Request Smuggling due to spaces in headers

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an attacker can use this flaw to inject...

Moderate: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: IBM UrbanCode Release is affected by CVE-2021-33037

Summary IBM UrbanCode Release version 6.2.2.7 - 6.2.5.4 are affected by CVE-2021-33037 Vulnerability Details CVEID: CVE-2021-33037 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a...

FAUST iServer 9.0.018.018.4 Local File Inclusion

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file inclusion vulnerability product: Land Software - FAUST iServer vulnerable version: 9.0.017.017.1-3 - 9.0.018.018.4 fixed version: 9.0.019.019.7, Version 10 CVE...

FAUST iServer 9.0.018.018.4 Local File Inclusion Vulnerability

Land Software's FAUST iServer versions 9.0.017.017.1-3 through 9.0.018.018.4 suffer from a local file inclusion vulnerability. ======================================================================= title: Local file inclusion vulnerability product: Land Software - FAUST iServer vulnerable versio...

Online Project Time Management System 1.0 - SQLi (Authenticated)

Exploit Title: Online Project Time Management System 1.0 - SQLi Authenticated Date: 19/01/2022 Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Exploit for Integer Overflow or Wraparound in Haproxy

CVE-2021-40346 Integer overflow on header request internal re...

10secondsofcode-custom (1.0.0), 123-x-ed-eied (>=1.0.5, <=1.0.6) +10689 more potentially affected by CVE-2022-0235 via node-fetch (>=2.0.0, <=2.6.6)

node-fetch NPM version =2.0.0, =1.0.5, =1.0.0, =1.0.1, =1.0.0-beta.32, =0.24.0, =0.0.8, =0.0.1, =0.0.0-alpha.1, =1.0.43, =0.0.80, =0.1.3-rc9 and more Source cves: CVE-2022-0235 Source advisory: OSV:GHSA-R683-J2X4-V87G...

The vulnerability of the HttpObjectDecoder.java component of the Netty network programming framework, related to a deficiency in HTTP request interpretation, allows attackers to access confidential data and compromise its integrity.

The vulnerability of the HttpObjectDecoder.java component of the Netty network programming framework is related to a deficiency in HTTP request interpretation. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2022:0101-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0101-1 advisory. - CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names bsc1194511. - CVE-2021-44532: Fixed certificate...

SUSE-SU-2022:0101-1 Security update for nodejs12

This update for nodejs12 fixes the following issues: - CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names bsc1194511. - CVE-2021-44532: Fixed certificate Verification Bypass via String Injection bsc1194512. - CVE-2021-44533: Fixed incorrect handling of certificate subject an...

Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-33193)

Summary IBM Rational Build Forge version 8.0.x is affected by CVE-2021-33193 Vulnerability Details CVEID: CVE-2021-33193 DESCRIPTION: Apache HTTP Server is vulnerable to HTTP request splitting attacks, caused by improper input validation in HTTP/2 message processing. A remote attacker could explo...

Exploit for CVE-2022-21907

CVE-2022-21907 - Double Free in http.sys driver !./.github...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2021-43297 Vulnerability Description There is a poten...

Improper Access Control in janeczku/calibre-web

Description With default settings, low-level users will not have permission to create new shelf with public mode. However, due to incorrect checking, the function does not work as intended. Steps To Reproduce - Step 1: Login with admin account and go to http://hostname:8083/admin/user/new. Create...

The vulnerability of the free Apache2 web server, related to HTTP request processing flaws, allows attackers to compromise data integrity.

The vulnerability of the free Apache2 web server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

OpenBMCS 2.4 Unauthenticated SSRF / RFI

Summary Building Management & Controls System BMCS. No matter what the size of your business, the OpenBMCS software has the ability to expand to hundreds of controllers. Our product can control and monitor anything from a garage door to a complete campus wide network, with everything you need on...