7127 matches found
CVE-2025-2825
CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability in the S3 authorization header processing that allows authentication bypass. Remote and unauthenticated HTTP requests to CrushFTP with known usernames can be used to impersonate a user and conduct...
CVE-2025-27726
The CVE-2025-27726 entry describes a path traversal in the USB storage file-sharing function of the HGW-BL1500HM router (versions 002.002.003 and earlier). The underlying issue allows a crafted HTTP request from a LAN-connected device to obtain and/or alter the product’s files. Affected component...
CVE-2025-27716
CVE-2025-27716 affects HGW-BL1500HM (Ver 002.002.003 and earlier) and is a path traversal vulnerability in the USB storage file-sharing function. The issue arises in the file/folder listing path handling, allowing a crafted HTTP request from a LAN-connected device to obtain and/or alter product f...
Azure Linux 3.0 Security Update: python-twisted (CVE-2023-46137)
The version of python-twisted installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46137 advisory. - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when...
CVE-2025-2825 CrushFTP HTTP Unauthenticated Access
CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability in the S3 authorization header processing that allows authentication bypass. Remote and unauthenticated HTTP requests to CrushFTP with known usernames can be used to impersonate a user and conduct...
CVE-2025-2825
This CVE entry is rejected/not used as it is a reservation duplicate of CVE-2025-31161 . All users should reference CVE-2025-31161 instead of this record.
Denial Of Service (DoS)
litellm is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of multipart boundaries, allowing an attacker to append characters in HTTP requests, leading to excessive resource consumption and service unavailability...
CVE-2022-39163: Inconsistent Interpretation of HTTP Requests
IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync CSD attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting XSS attacks...
Silicon Gecko OS security vulnerabilities
Silicon Gecko OS is a highly optimized and feature-rich IoT operating system from Silicon. A security vulnerability exists in Silicon Gecko OS that stems from a stack buffer overflow in HTTP request processing that could lead to remote code execution...
BIT-VARNISH-2025-30346
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests...
D-Link DAP-1620 check_dws_cookie() Code Execution
The vulnerability of the checkdwscookie function in the wireless repeater software developed by D-Link DAP-1620 lies in the fact that the operation’s output escapes the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a service failu...
D-Link DAP-1620 wireless repeater set_ws_action() Data Compromise
The vulnerability of the setwsaction function in D-Link DAP-1620 wireless repeater microprogramming software lies in the fact that the operation’s output escapes the buffer and enters memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and...
PT-2025-12658
Name of the Vulnerable Software and Affected Versions FortiSandbox versions 3.2.2 and below FortiSandbox versions 3.1.4 and below Description A stack-based buffer overflow issue in the profile parser may allow an authenticated attacker to potentially execute unauthorized code or commands via...
CVE-2025-30346
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests...
CVE-2025-30346
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests...
CVE-2025-30346
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests...
CVE-2025-30346
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests...
CVE-2025-30346
Varnish Cache and Varnish Enterprise are affected by CVE-2025-30346: a HTTP/1 client-side desync vulnerability that can be triggered by malformed HTTP/1 requests. Affected versions are Varnish Cache prior to 7.6.2 and Varnish Enterprise prior to 6.0.13r10. The vulnerability description in connect...
