CVE-2023-43849

Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmware image via HTTP POST requests. This may result in DoS or remote code execution...

CVE-2023-43847

Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were the administrator via HTTP POST requests...

PT-2024-13145 · Aten · Aten Pe6208

Name of the Vulnerable Software and Affected Versions: Aten PE6208 versions 2.3.228 through 2.4.232 Description: The issue is related to incorrect access control in the outlet control function of the web interface, allowing remote authenticated users to control all outlets as if they were the...

tomcat: Leaking of unrelated request bodies in default error page

An information disclosure vulnerability was found in Apache Tomcat. Incomplete POST requests triggered an error response that could contain data from a previous HTTP request. This flaw allows a remote attacker to access files from another user that should be otherwise prevented by limits or...

The vulnerability of the fromNatStaticSetting function in the microprogramming software for Tenda FH1206 allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the fromNatStaticSetting function in the microprogramming software for Tenda FH1206 is related to the execution of operations outside the buffer in memory when processing the page parameter ip/goform/NatStaticSetting. Exploiting this vulnerability allows a malicious actor to...

Ubuntu: Security Advisory (USN-6770-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6770-1 fossil regression

USN-6729-1 fixed vulnerabilities in Apache HTTP Server. The update lead to the discovery of a regression in Fossil with regards to the handling of POST requests that do not have a Content-Length field set. This update fixes the problem. We apologize for the inconvenience...

tomcat: Leaking of unrelated request bodies in default error page

An information disclosure vulnerability was found in Apache Tomcat. Incomplete POST requests triggered an error response that could contain data from a previous HTTP request. This flaw allows a remote attacker to access files from another user that should be otherwise prevented by limits or...

V-SOL G/EPON ONU HG323AC-B 安全漏洞

The V-SOL G/EPON ONU HG323AC-B is a dual-band EasyMesh router from China's CoreTech V-SOL. A security vulnerability exists in the V-SOL G/EPON ONU HG323AC-B version V2.0.08-210715. An attacker can exploit the vulnerability to execute arbitrary code and obtain sensitive information via a specially...

The vulnerability of the formSetAutoPing function in the Tenda i21 router microprogramming software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetAutoPing function in Tenda i21 router microprogramming software is related to buffer overflows in the stack when processing the ping1/ping2 parameter. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and...

GHSA-5M98-QGG9-WH84 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...

CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

aiohttp 安全漏洞

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. A security vulnerability exists in aiohttp versions prior to 3.9.4, which results in a denial of service when attempting to parse a malformed POST request...

PuneethReddyHC Event Management 安全漏洞

PuneethReddyHC Event Management is an application by Puneeth Reddy H C Individual Developer. Helps users to register for events organized in university festivals with simple logic and security. A security vulnerability exists in PuneethReddyHC Event Management version 1.0, which stems from the...

GHSA-MV64-86G8-CQQ7 Quarkus: security checks in resteasy reactive may trigger a denial of service

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...

CVE-2024-1726 Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of user-supplied input in the server's handlers, allowing attackers to access arbitrary files on the server by crafting HTTP POST requests with specially crafted parameters...

Remote Code Execution (RCE)

bentoML is vulnerable to an Remote Code Execution RCE. The vulnerability is due to missing media type checks when handling serialized objects, resulting remote code execution through crafted POST requests containing pickled objects...

CVE-2024-1569

parisneo/lollms-webui is vulnerable to a denial of service DoS attack due to uncontrolled resource consumption. Attackers can exploit the /opencodeinvscode and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the...

CVE-2024-1569 Uncontrolled Resource Consumption in parisneo/lollms-webui

parisneo/lollms-webui is vulnerable to a denial of service DoS attack due to uncontrolled resource consumption. Attackers can exploit the /opencodeinvscode and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the...