Siretta QUARTZ-GOLD file writing vulnerability

Siretta QUARTZ-GOLD is an industrial router with multiple features and services.A file-writing vulnerability exists in Siretta QUARTZ-GOLD, which can be exploited by attackers to cause arbitrary file uploads via specially crafted HTTP requests...

InHand Networks InRouter302 httpd upload.cgi Unlimited File Upload

The vulnerability of the httpdupload.cgi component of InHand Networks’ InRouter302 microprogramming system involves unlimited uploading of dangerous files. Exploiting this vulnerability allows a malicious actor to upload any files into the system using a specially created HTTP request...

PHP Development Server Information Disclosure Vulnerability

PHP is a widely used general purpose scripting language that is particularly well suited for web development and can be embedded in HTML.An information disclosure vulnerability exists in PHP Development Server, which stems from a logic flaw in the php cli server begin send static when parsing htt...

Siretta QUARTZ-GOLD Directory Traversal Vulnerability (CNVD-2023-17077)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to a directory traversal vulnerability that could be exploited by attackers to send specially crafted HTTP requests resulting in arbitrary file reads...

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17074)

Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta. Siretta QUARTZ-GOLD is vulnerable to a buffer overflow vulnerability, which can be exploited by attackers to cause a heap buffer overflow by sending specially crafted HTTP requests...

Siretta QUARTZ-GOLD OS Command Injection Vulnerability (CNVD-2023-17084)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to OS command injection, which can be exploited by attackers to cause arbitrary commands to be executed by sending crafted HTTP requests...

Siretta QUARTZ-GOLD Directory Traversal Vulnerability (CNVD-2023-17076)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to a directory traversal vulnerability that could be exploited by an attacker to send specially crafted HTTP requests resulting in arbitrary file deletion...

Ubuntu: Security Advisory (USN-4796-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-4442-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Command injection

An os command injection vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

Vulnerability Spotlight: OS command injection, directory traversal and other vulnerabilities found in Siretta Quartz-Gold and FreshTomato

Francesco Benvenuto of Cisco Talos discovered these vulnerabilities. Cisco Talos recently discovered several vulnerabilities in the Siretta Quartz-Gold router. Talos also discovered vulnerabilities in FreshTomato while investigating the Siretta router. The Siretta Quartz-Gold is an industrial...

PT-2023-13903 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: A command injection issue exists in the httpd delfile.cgi functionality, allowing an attacker to execute arbitrary commands via a specially-crafted HTTP request. This can lead to...

Siretta QUARTZ-GOLD path traversal vulnerability

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to a directory traversal vulnerability that could be exploited by attackers to send specially crafted HTTP requests resulting in arbitrary file reads...

Siemens SCALANCE X-300 Switches Buffer Copy Without Checking Size of Input (CVE-2022-26334)

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

Server-Side Request Forgery (SSRF)

rsshub is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists due to unsafe route parameter sanitation, which allows an attacker to send arbitrary HTTP requests from the server to other servers...

CVE-2023-20020

A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due...

Input validation

A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due...

CVE-2023-20020

A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due...

Interesting new filters on Spring Cloud Gateway 4.0

Spring Cloud Gateway 4.0 is finally here! Thanks to our community contributions we have introduced new features and interesting filters. This blog post details new noteworthy and explains some of the new filters included, how they work and how you can use it to provide more insights into your...

Mitsubishi Electric MELSEC iQ-F series security vulnerabilities

The Mitsubishi Electric MELSEC iQ-F series is a programmable logic controller from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC iQ-F series v1.240 version that stems from a specially crafted HTTP request that could lead to session cookie leakage...