7944 matches found
ipTIME NAS 跨站请求伪造漏洞
ipTIME NAS is a wireless router product from South Korea's ipTIME Corporation that provides NAS network attached storage. A security vulnerability exists in ipTIME NAS that stems from a lack of validation of POST requests sent to a page. An attacker can exploit this vulnerability to delete user...
Nextcloud: Mail app - blind SSRF via imapHost parameter
A blind SSRF vulnerability was discovered in the Nextcloud Mail application. An attacker could exploit this vulnerability to retrieve services running locally on the server and scan the internal network for information about which IPs are responding and which services are running on each IP...
CVE-2022-34022
SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive...
Sql injection
SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive...
CVE-2022-34022
SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive...
Ublsoftware ResIOT SQL注入漏洞
Ublsoftware ResIOT is a web server and IoT platform from the Italian company ResIOT. A security vulnerability exists in Ublsoftware ResIOT versions prior to 4.1.1000114, which stems from an attacker realizing SQL injection by sending a crafted POST request to /ResiotQueryDBActive...
CVE-2022-34022
SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive...
PT-2022-6651 · Juniper Networks · Junos
Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 19.1R3-S9 Junos OS versions 19.2 prior to 19.2R3-S6 Junos OS versions 19.3 prior to 19.3R3-S7 Junos OS versions 19.4 prior to 19.4R3-S9 Junos OS versions 20.1 prior to 20.1R3-S5 Junos OS versions 20.2 prior to...
DEBIAN-CVE-2022-39290
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web application. These modifications include replacing HTTP POST with an HTTP GET and removing the CS...
LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API
The plugin unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution RCE. To successfully exploit this vulnerability attackers must have knowledge of the site...
CVE-2022-21826
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down...
CVE-2022-21826
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down...
CVE-2022-21826
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down...
Stack overflow
Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows attackers to cause a Denial of Service DoS or Remote Code Execution RCE via the portMappingServer, portMappingProtocol, portMappingWan,...
Tenda W20E 缓冲区错误漏洞
The Tenda W20E is a router from the Chinese company Tenda. A stack overflow vulnerability exists in Tenda W20E router version V15.11.0.6, which originates from the formSetPortMapping method not size-checking the input data when goform/setPortMapping/ with a POST request, and can be exploited to...
Remote Code Execution
valine is vulnerable to remote code execution. A remote attacker is able to upload and execute malicious code on the system under attack via a crafted POST request...
Valine code injection vulnerability
Valine was discovered to contain a remote code execution RCE vulnerability which allows attackers to execute arbitrary code via a crafted POST request...
GHSA-MCVG-G9WX-V5VX Valine code injection vulnerability
Valine was discovered to contain a remote code execution RCE vulnerability which allows attackers to execute arbitrary code via a crafted POST request...