CVE-2021-35243

The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server 12.7.7 and earlier, allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the...

CVE-2021-43807

Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE...

The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.

...

Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-01598)

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. Used to provide reliable and always-on 5G Wi-Fi connectivity, the Lantronix PremierWave 2050 in version 8.9.0.0R4 is vulnerable to OS command injection, which can be exploited by attackers to execute...

GSD-2021-1002118 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.15 by commit 4e5d794a2743f5a1e13ee1066ce37711f2696044...

The vulnerability of the `file_get_contents()` and `file_put_contents()` methods in the Ignition PHP framework’s Laravel library allows a attacker to execute arbitrary code.

The vulnerability of the filegetcontents and fileputContents methods in the Ignition PHP framework’s Laravel library is related to improper code generation. Exploiting this vulnerability may allow an attacker to execute arbitrary code...

PT-2021-7644 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Android kernel Description: The issue is related to a memory corruption vulnerability in the backing-dev.c file of the Linux operating system, specifically in the bdi put and bdi unregister...

Prototype Pollution

dotty is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes via the put function and modify attributes such as proto, constructor, and prototype...

[SECURITY] Fedora 35 Update: curl-7.79.1-1.fc35

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw Vulnerability

Exploit Title: i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw Exploit Author: LiquidWorm Vendor Homepage: https://www.i3international.com i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw Vendor: i3 International Inc. Product web page:...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Activemq

This is a Python script for exploiting a vulnerability in Apache ActiveMQ. The script is designed to upload a shell to the server using the PUT method. The vulnerability being exploited is CVE-2016-3088. The script requires the user to provide the URL of the ActiveMQ server, the username, and the...

LazyCSRF - A More Useful CSRF PoC Generator

LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. Motivation Burp Suite is an intercepting HTTP Proxy, and it is the defacto tool for performing web application security testing. The feature of Burp Suite that I like the most is Generate CSRF PoC. However, this does not suppor...

Similar Posts < 3.1.6 - Admin+ Arbitrary PHP Code Execution

The plugin allow high privilege users to execute arbitrary PHP code in an hardened environment ie with DISALLOWFILEEDIT, DISALLOWFILEMODS and DISALLOWUNFILTEREDHTML set to true via the 'widgetrrmsimilarpostscondition' widget setting of the plugin. Vendor was notified in July 2021, the issue was...

CVE-2021-41295

CVE-2021-41295 affects ECOA Building Automation System CSRF in the ECOA BAS controller. Concrete details: vulnerable components include ECOA ECS Router Controller (ECS FLASH), ECOA RiskBuster Terminator (E6L45), ECOA RiskBuster System (RB 3.0.0 / TRANE 1.0), ECOA Graphic Control Software, ECOA Sm...

libde265缓冲区错误漏洞

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the putqpel00fallback16 function. An attacker can exploit the vulnerability to cause a denial of service via specially crafted files...

EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution

The plugin does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code As a contributor, create/edit a post and put the below code while in Code Editor mode: \naa\n Save or Preview the page,...

HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting (XSS)

Exploit Title: HP OfficeJet 4630/7110 MYM1FN2025AR 2117A – Stored Cross-Site Scripting XSS Date: 01/08/2021 Exploit Author: Tyler Butler Vendor Homepage: https://www8.hp.com/ Vendor Bulletin: https://support.hp.com/ie-en/document/ish4433829-4433857-16/hpsbpi03742 Researcher Bulletin:...

UBUNTU-CVE-2020-21680

A stack-based buffer overflow in the putarrow component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service DOS via converting a xfig file into pict2e format...

Buffer overflow

A global buffer overflow in the putfont in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service DOS via converting a xfig file into pict2e format...

Xfig fig2dev 缓冲区错误漏洞

fig2dev is used to convert .fig files to various graphics languages and formats. A global buffer overflow vulnerability exists in putfont in genpict2e.c in fig2dev version 3.2.7b. An attacker could exploit this vulnerability to cause a denial of service by converting xfig files to pict2e format...