431 matches found
CVE-2022-47070
NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the server will return the correct password information...
CVE-2020-26526
An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...
CVE-2019-10771
Characters in the GET url path are not properly escaped and can be reflected in the server response...
CVE-2019-19821
A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages...
PT-2025-21778 · Unknown · Rsi Queue Management System
Name of the Vulnerable Software and Affected Versions: RSI Queue Management System version 3.0 Description: An unauthenticated blind SQL injection issue exists within the TaskID parameter of the GET request handler. This allows attackers to remotely inject time-delayed SQL payloads, inducing serv...
Alibaba Cloud Linux 3 : 0226: grafana (ALINUX3-SA-2024:0226)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0226 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-24791: The net/http HTTP/1.1 client...
net-imap rubygem vulnerable to possible DoS by memory exhaustion
Summary There is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader...
Net::IMAP 安全漏洞
Net::IMAP is a Ruby client api for the Message Access Protocol in the Ruby open source. A security vulnerability exists in Net::IMAP, which stems from a mishandling of server responses leading to memory exhaustion, which could result in a denial of service. The following versions are affected:...
DEBIAN-CVE-2025-1217
In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME...
Username Enumeration
Flask-AppBuilder is vulnerable to Username Enumeration. The vulnerability is due to differences in server response time when brute forcing login requests, allowing unauthenticated users to enumerate existing usernames...
Linux Distros Unpatched Vulnerability : CVE-2021-38370
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. CVE-2021-38370 Note that Nessus relies on the presence of the packag...
Linux Distros Unpatched Vulnerability : CVE-2020-1695
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation...
CVE-2024-57778
An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200...
Orbe ONetView Roteador Onet-1200 安全漏洞
Orbe ONetView Roteador Onet-1200 is a router from Orbe Brazil. A security vulnerability exists in the Orbe ONetView Roteador Onet-1200 that originates from a remote attacker being able to elevate privileges from status code 500 to status code 200 via a server response...
CVE-2024-57778
CVE-2024-57778 affects the Orbe ONetView Onet-1200 router. The issue allows a remote attacker to escalate privileges by exploiting a server response flow that changes from HTTP 500 to HTTP 200. Documents consistently describe the affected device as Orbe ONetView Roeador Onet-1200/Onet-1200 and in...
CVE-2025-23193 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server...
CVE-2024-42330
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...
CVE-2024-42328
When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curlwritecb when receiving data. If the server's response is an empty document, then wd-data in the code below will remain NULL and an attempt to read from it will...
UBUNTU-CVE-2024-42328
When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curlwritecb when receiving data. If the server's response is an empty document, then wd-data in the code below will remain NULL and an attempt to read from it will...
CVE-2024-42330 JS - Internal strings in HTTP headers
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...