Information Disclosure

reactor-netty is vulnerable to information disclosure. A remote attacker is able to request log headers in some cases of invalid HTTP requests which may reveal valid access tokens when WARN level is enabled, resulting in disclosure of sensitive information...

Moxa MXView Full Access

The vulnerability of the Moxa MXView network control software web interface is related to the use of strictly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to gain full access to the device by sending a specially crafted HTTP request...

Abode Iota operating system command injection vulnerability

Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota versions 6.9X and 6.9Z, which stems from an os command injection in the web interface utilsetabodecode function and can be exploited by an attacker to execute...

Abode Systems, Inc. iota All-In-One Security Kit web interface /action/ipcamRecordPost OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1563 Abode Systems, Inc. iota All-In-One Security Kit web interface /action/ipcamRecordPost OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-32586 SUMMARY An OS command injection vulnerability exists in the web interface...

CVE-2022-31684

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...

CVE-2022-31684

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...

CVE-2022-31684

CVE-2022-31684 affects Tanzu VMware Reactor Netty (HTTP Server) versions 1.0.11–1.0.23. The issue is that request headers may be logged in certain invalid HTTP requests when WARN logging is enabled, potentially exposing valid access tokens found in those logs. The connected Red Hat and IBM adviso...

CVE-2022-40684

An authentication bypass using an alternate path or channel CWE-288 in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform...

CVE-2022-40684: Improper Authentication

An authentication bypass using an alternate path or channel CWE-288 in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform...

Werkzeug XSS

The vulnerability of the Pallets Werkzeug web application lies in its lack of proper HTTP request processing. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially crafted HTTP requests...

CVE-2022-2428

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

UBUNTU-CVE-2022-2428

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

CVE-2022-2428: Improper Neutralization of Input During Web Page Generation

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

CVE-2022-2428

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

CVE-2022-2428

CVE-2022-2428 affects GitLab EE/CE where a crafted tag in the Jupyter Notebook viewer enables an attacker to issue arbitrary HTTP requests. The issue affects all GitLab releases before 15.1.6, and across 15.2 (15.2.0–15.2.4) and 15.3 (15.3.0–15.3.2). Notably, the vulnerability is tied to the Jupy...

CVE-2022-2428

Removed by vendor...

CVE-2022-2428

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

CVE-2022-2428

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

MGASA-2022-0369 Updated lighttpd packages fix security vulnerability

In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. CVE-2022-37797 A...

ROS-20221007-02

Vulnerability of lighttpd web server is related to memory leak in modfastcgi and modscgi modules while processing a large number of incorrect HTTP requests. a large number of malformed HTTP requests. Exploiting the vulnerability could allow an attacker, acting remotely, send multiple invalid HTTP...