CVE-2022-29013

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request...

VulnCheck KEV: CVE-2016-2388

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request...

python-twisted: possible http request smuggling

A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length header, '\n and \t' etc. Non-conformant parsing leads to a desync if requests pass through multiple HTT...

Carrier LenelS2 HID Mercury access panels 路径遍历漏洞

Carrier LenelS2 HID Mercury access panels is a controller panel from Carrier, U.S. A path traversal vulnerability exists in Carrier LenelS2 HID Mercury access panels, which could be exploited to send specially crafted HTTP requests to upload arbitrary files to an arbitrary location on the system...

CVE-2022-20802

A vulnerability in the web interface of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by...

Pallets Werkzeug 环境问题漏洞

Pallets Werkzeug is a WSGI web application library. An environmental issue vulnerability exists in Pallets Werkzeug version 2.1.0 and prior versions that stems from incorrectly parsing HTTP requests. An attacker could use this vulnerability to perform HTTP request smuggling via a specially crafte...

Denial of service in .NET core

.NET Core and Visual Studio Denial of Service Vulnerability due to a vulnerability which exists when creating HTTPS web request during X509 certificate chain building...

GHSA-3CF7-7WQ6-8842 ASP.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'...

GHSA-RF8F-HQJV-986P Shopware Insecure Deserialization Vulnerability

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

Shopware Insecure Deserialization Vulnerability

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

TotoLink A3100R Access Control Error Vulnerability (CNVD-2022-54651)

TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R versions V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to an access control error, which could be exploited by attackers to to obtain sensitive information via a crafted web request...

CVE-2022-29646

An access control issue in TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 allows attackers to obtain sensitive information via a crafted web request...

Design/Logic Flaw

An access control issue in TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 allows attackers to obtain sensitive information via a crafted web request...

CVE-2022-29646

An access control issue in TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 allows attackers to obtain sensitive information via a crafted web request...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

GHSA-VPR3-F594-MG5G Improper Control of Generation of Code ('Code Injection') in Spring Framework

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs0=jar: followed by a URL of a crafted .jar file...

CVE-2022-24393

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “checkverticaupgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost...

GHSA-M899-6MH4-MPC5 MODX Revolution Incorrect Access Control vulnerability

MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...

MODX Revolution Incorrect Access Control vulnerability

MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...

CVE-2022-21182

A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability...