Improper Request Handling

http-proxy-middleware is vulnerable to Improper Request Handling. The vulnerability is due to improper request handling caused by fixRequestBody executing even when bodyParser has failed, which allows attackers to smuggle malicious HTTP requests...

PCMan FTP Server 安全漏洞

PCMan FTP Server is a server software for File Transfer Protocol FTP. PCMan FTP Server suffers from a buffer overflow vulnerability that stems from the failure of the DIR Command Handler module DIR Command Handler to properly handle a specific request. No detailed vulnerability details are provid...

CVE-2025-32395

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

Authentication Bypass

Apache Pinot is vulnerable to Authentication Bypass. The vulnerability is due to improper request path validation due to the application's failure to enforce authentication when the request path contains a semicolon ; and lacks a forward slash /, allowing unauthorized user creation...

The vulnerability of the ocelot_ifh_set_basic() function in the ocelot.c component of the Linux operating system’s kernel allows a hacker to induce a service failure.

The vulnerability of the ocelotifhsetbasic function in the ocelot.c component of the Linux operating system’s kernel is related to insufficient neutralization of certain elements in the request. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unexpected Status Code Or Return Value

go-redis is vulnerable to Unexpected Status Code or Return Value. The vulnerability is due to improper request handling due to timeouts in the CLIENT SETINFO command during connection establishment, leading to incorrect command responses and potential data inconsistency...

Cross-Site Request Forgery (CSRF)

org.jenkins-ci.main, jenkins-core is vulnerable to Cross-site request forgery CSRF. The vulnerability is due to improper request validation, which allows unauthorized state changes in Jenkins' UI when a user unknowingly triggers a malicious request...

Edimax IC-7100 操作系统命令注入漏洞

Edimax IC-7100 is a security camera from China Xunzhou Edimax. The Edimax IC-7100 IP Camera suffers from an operating system command injection vulnerability that stems from an improperly neutralized request and could lead to remote code execution...

CVE-2025-1969: Reliance on Untrusted Inputs in a Security Decision

Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...

Regular Expression Denial Of Service (ReDoS)

@octokit/plugin-paginate-rest is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to improper handling of the link parameter in the headers section of the request, which allows a specially crafted input to exploit the regular expression logic and trigger a denial...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from improper request handling in the RDMA/rxe module, resulting in a memory leak...

Server Side Request Forgery (SSRF)

@lobehub/chat is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to insufficient input validation and improper handling of requests, allowing attackers to craft requests that can target internal services, even without authentication...

PT-2024-23194 · Hcl · Hcl Connections

Name of the Vulnerable Software and Affected Versions: HCL Connections affected versions not specified Description: The issue is related to an information disclosure vulnerability. It could allow a user to obtain sensitive information they are not entitled to because of improperly handling the...

CVE-2024-30118: Exposure of Sensitive Information to an Unauthorized Actor

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to because of improperly handling the request data...

The vulnerability of the twisted.web network framework’s component, which allows a hacker to disclose protected information

The vulnerability of the twisted.web network framework’s component is related to improper handling of HTTP requests. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the framework...

Server-Side Request Forgery (SSRF)

github.com/gotenberg/gotenberg/v8 is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper handling of requests made to the /convert/html endpoint, allowing attackers to exploit local file inclusion by referencing localhost files such as...

Remote Code Execution

jeecg-boot is vulnerable to SSTI Injection. The vulnerability is caused due to improper request verification within the jmreport/loadTableData component. This could allows remote attackers to execute arbitrary code via crafted HTTP requests...

CVE-2023-28022 HCL Connections is vulnerable to sensitive information disclosure

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data...

The vulnerability of the WebSocket technology in the Quarkus Java framework allows attackers to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the WebSocket technology in the Quarkus Java framework is related to the improper implementation of the sequence of actions performed during request processing, due to insufficient access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access...

PT-2023-36319 · Atftp · Atftp

Name of the Vulnerable Software and Affected Versions: atftp affected versions not specified Description: The issue arises from atftp's improper management of requests made to non-existent files, potentially leading to a crash. A remote attacker could exploit this to cause a denial of service...