432 matches found
POST following PUT confusion
When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...
CVE-2022-32221
When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...
UBUNTU-CVE-2022-32221
When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...
PT-2022-5975
Name of the Vulnerable Software and Affected Versions libcurl versions prior to 7.86.0 Description When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPT READFUNCTION to ask for data to send, even when the CURLOPT POSTFIELDS option has been set, if the same handle...
curl -- multiple vulnerabilities
Daniel Stenberg reports: CVE-2022-32221: POST following PUT confusion When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT...
GHSA-5JP2-VWRJ-99RF Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution
Impact For some Post/Put Concourse endpoint containing :teamname in the URL, a Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to...
Design/Logic Flaw
A vulnerability in Suprema BioStar aka Bio Star 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page...
CVE-2022-38351
Summary: CVE-2022-38351 affects Suprema BioStar 2 (Bio Star) 2.x, specifically v2.8.16, enabling privilege escalation to System Administrator via a crafted PUT request to the update profile page. What is affected: Suprema BioStar 2, version 2.8.16 (BioStar 2). The vulnerability exists in the API ...
CVE-2022-38351
A vulnerability in Suprema BioStar aka Bio Star 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page...
CVE-2022-38351: Improper Privilege Management
A vulnerability in Suprema BioStar aka Bio Star 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page...
Fileserver Application Apache ActiveMQ Download Execution
The vulnerability of the Fileserver application of the Apache ActiveMQ software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to upload and execute any file using the HTTP PUT method, followed by an HTTP MOVE request...
PT-2026-34853
Name of the Vulnerable Software and Affected Versions Delta Electronics AS320T affected versions not specified Description The web service contains an incorrect calculation of the buffer size on the stack within the GET/PUT request handler. This occurs when processing requests, which can lead to...
IBM ISS BlackICE PC security vulnerabilities
IBM ISS BlackICE PC is a personal firewall/IDS for Windows desktops from International Business Machines IBM. A security vulnerability exists in IBM ISS BlackICE PC Protection that stems from Cross Site Scripting Detection causing an elevation of privilege when processing operations that are part...
Hikvision IP Camera Unauthenticated Command Injection Exploit
This Metasploit module exploits an unauthenticated command injection in a variety of Hikvision IP cameras CVE-2021-36260. The module inserts a command into an XML payload used with an HTTP PUT request sent to the /SDK/webLanguage endpoint, resulting in command execution as the root user. This...
CVE-2022-22836
CoreFTP Server before 727 allows directory traversal for file creation by an authenticated attacker via ../ in an HTTP PUT request...
Directory traversal
CoreFTP Server before 727 allows directory traversal for file creation by an authenticated attacker via ../ in an HTTP PUT request...
CoreFTP Server build 725 - Directory Traversal (Authenticated)
Exploit Title: CoreFTP Server build 725 - Directory Traversal Authenticated Date: 08/01/2022 Exploit Author: LiamInfosec Vendor Homepage: http://coreftp.com/ Version: build 725 and below Tested on: Windows 10 CVE : CVE-2022-22836 Description: CoreFTP Server before 727 allows directory traversal f...
CVE-2022-22836
CoreFTP Server before 727 allows directory traversal for file creation by an authenticated attacker via ../ in an HTTP PUT request...
Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-01598)
The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. Used to provide reliable and always-on 5G Wi-Fi connectivity, the Lantronix PremierWave 2050 in version 8.9.0.0R4 is vulnerable to OS command injection, which can be exploited by attackers to execute...
i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw Vulnerability
Exploit Title: i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw Exploit Author: LiquidWorm Vendor Homepage: https://www.i3international.com i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw Vendor: i3 International Inc. Product web page:...