677 matches found
CVE-2021-44429
Serva 4.4.0 allows remote attackers to cause a denial of service daemon crash via a TFTP read RRQ request, aka opcode 1, a related issue to CVE-2013-0145...
CVE-2021-41732
An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended...
CVE-2021-40099
An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution...
Akaunting 安全漏洞
Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. A security vulnerability exists in Akaunting. The vulnerability stems from setting a misformatted locale variable and sending it in an otherwise normal HTTP POST request, which can lead to...
CVE-2021-21819
A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...
Remote code execution
A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...
MOXA Mgate MB3180 Denial of Service Vulnerability
The MOXA MGate MB3180 is a technology product with a port transfer rate of 0.9216 Mbps. A denial of service exists in MOXA Mgate MB3180 version 2.1 Build 18113012. An attacker can exploit this vulnerability by sending an incomplete HTTP request using the slowhttptest utility to exhaust the...
HongCMS Path Traversal Vulnerability
HongCMS Chinese and English website system is a lightweight website system with extremely fast access speed and easy to use. HongCMS version 4.0.0 suffers from a path traversal vulnerability. A remote attacker can exploit this vulnerability by sending a specially crafted POST request to the...
OctoPrint Cross-Site Request Vulnerability
OctoPrint is an application. Provides a fast web interface for controlling consumer 3D printers. A cross-site request vulnerability existed prior to OctoPrint version 1.6.0. The vulnerability originated in the program because an API error message included the value of an input parameter. No...
Sql injection
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the The nomenclature parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...
CVE-2020-27233
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...
SonicWall Email Security pre-authentication administrative account creation vulnerability
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. CVE: CVE-2021-20021 Last updated: April 9, 2021, 5:12 p.m...
CVE-2020-28502
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...
CVE-2021-27730
Accellion FTA 912432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA912444 and later...
Nagios XI OS Command Injection Vulnerability (CNVD-2021-11072)
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An OS command injection vulnerability exists in /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php in Nagios XI...
Cross site request forgery (csrf)
A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to trigger this vulnerability...
Accellion FTA 代码问题漏洞
Accellion File Transfer Appliance FTA is a secure file transfer service that allows users to share and synchronize files online, all encrypted with AES 128/256. A server-side request forgery vulnerability exists in Accellion FTA 912411 and earlier versions. An attacker can exploit this...
Security update for privoxy (moderate)
openSUSE Security Update: Security update for privoxy Announcement ID: openSUSE-SU-2021:0279-1 Rating: moderate References: 1181650 Cross-References: CVE-2021-20216 CVE-2021-20217 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes two vulnerabilities is now available...
CVE-2020-13574
A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...