CVE-2023-28359

A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the...

CVE-2022-47070

NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the server will return the correct password information...

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

CVE-2019-10771

Characters in the GET url path are not properly escaped and can be reflected in the server response...

CVE-2019-19821

A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages...

PT-2025-21778 · Unknown · Rsi Queue Management System

Name of the Vulnerable Software and Affected Versions: RSI Queue Management System version 3.0 Description: An unauthenticated blind SQL injection issue exists within the TaskID parameter of the GET request handler. This allows attackers to remotely inject time-delayed SQL payloads, inducing serv...

Alibaba Cloud Linux 3 : 0226: grafana (ALINUX3-SA-2024:0226)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0226 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-24791: The net/http HTTP/1.1 client...

net-imap rubygem vulnerable to possible DoS by memory exhaustion

Summary There is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader...

Net::IMAP 安全漏洞

Net::IMAP is a Ruby client api for the Message Access Protocol in the Ruby open source. A security vulnerability exists in Net::IMAP, which stems from a mishandling of server responses leading to memory exhaustion, which could result in a denial of service. The following versions are affected:...

DEBIAN-CVE-2025-1217

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME...

Username Enumeration

Flask-AppBuilder is vulnerable to Username Enumeration. The vulnerability is due to differences in server response time when brute forcing login requests, allowing unauthenticated users to enumerate existing usernames...

Linux Distros Unpatched Vulnerability : CVE-2021-38370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. CVE-2021-38370 Note that Nessus relies on the presence of the packag...

Linux Distros Unpatched Vulnerability : CVE-2020-1695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation...

CVE-2024-57778

An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200...

CVE-2024-57778

The Orbe ONetView Roteador Onet-1200 (Orbe 1680210096) is vulnerable to a privilege escalation issue where a remote attacker can manipulate the server's response. By intercepting a 500 error code and changing it to a 200 status code using a tool like Burp Suite, an attacker can gain unauthorized ...

Orbe ONetView Roteador Onet-1200 安全漏洞

Orbe ONetView Roteador Onet-1200 is a router from Orbe Brazil. A security vulnerability exists in the Orbe ONetView Roteador Onet-1200 that originates from a remote attacker being able to elevate privileges from status code 500 to status code 200 via a server response...

CVE-2025-23193 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server...

CVE-2024-42330

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...

CVE-2024-42328

When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curlwritecb when receiving data. If the server's response is an empty document, then wd-data in the code below will remain NULL and an attempt to read from it will...

UBUNTU-CVE-2024-42328

When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curlwritecb when receiving data. If the server's response is an empty document, then wd-data in the code below will remain NULL and an attempt to read from it will...