6244 matches found
RATELIMITED: HTTP PUT method enabled
Hi security team, Summary: It is possible to upload files to the server using the PUT method Steps To Reproduce: 1. I used the following request: PUT /emitrani.txt HTTP/1.1 Host: ratelimited.me Content-Length: 10 Connection: close emitrani POC Now a file exists at...
CVE-2018-12613
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include view and potentially execute files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An...
scott-blanch-weather-app path traversal vulnerability
scott-blanch-weather-app is a Node.js weather app built with Express. A path traversal vulnerability exists in scott-blanch-weather-app. An attacker can exploit this vulnerability by placing a '... /' sequence in the URL to gain access to the file system...
Reliable Controls MACH-ProWebCom Information Disclosure Vulnerability
The Reliable Controls MACH-ProWebCom is a building controller from Canada's Reliable Controls that supports custom programming and has a built-in web server. A security vulnerability exists in Reliable Controls MACH-ProWebCom version 7.80. A remote attacker can exploit the vulnerability by sendin...
CVE-2018-12564
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml...
Security Bulletin: Executing a query with an OLAP specification causes the DB2 server to terminate database connections. (CVE-2013-6717)
Summary A vulnerability in IBM DB2 could allow a remote, authenticated user to cause a DB2 LUW server to terminate all connections to a database and deactivate the database. This only affects the database which the user is connected to. Vulnerability Details CVE ID: CVE-2013-6717 DESCRIPTION: The...
CVE-2018-4842
CVE-2018-4842 affects Siemens SCALANCE X switches (X-200, X-200 IRT, X-300; incl. SIPLUS NET) with HRP enabled, allowing remote, authenticated attackers with access to the configuration web server to store script code (XSS) in the hosted web page. Affected versions: X-200 < v5.2.3 (note: CVE-2...
CVE-2018-10088
Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725...
Directory Traversal
serverabc is vulnerable to directory traversal attacks. This attack is possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...
Directory Traversal
serverxxx is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...
zwserver directory traversal vulnerability
zwserver is a web server. A directory traversal vulnerability exists in zwserver. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...
section2.madisonjbrooks12 Directory Traversal Vulnerability
section2.madisonjbrooks12 is a simple web server. A directory traversal vulnerability exists in section2.madisonjbrooks12. An attacker can cause a directory traversal vulnerability by placing the ". /" in a URL to access the file system...
Directory Traversal
serverliujiayi1 is vulnerable to directory traversal attacks. The attack is possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...
Directory Traversal
serverlyr is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...
CVE-2017-16211
lessindex is a static file server. lessindex is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...
CVE-2017-16192
getcityapi.yoehoehne is a web server. getcityapi.yoehoehne is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...
CVE-2017-16199
susu-sum is a static file server. susu-sum is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...
CVE-2017-16178
intsol-package is a file server. intsol-package is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...