2941 matches found
Input validation
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request...
Command injection
Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web reques...
CVE-2018-1000044
Security Onion Solutions Squert version 1.1.1 through 1.6.7 contains a SQL Injection vulnerability in .inc/callback.php that can result in execution of SQL commands. This attack appear to be exploitable via Web request to .inc/callback.php with the payload in the sensors parameter, used in ec. Th...
CVE-2018-1000023
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request...
CVE-2018-5319
RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request...
HTTP authentication leak in redirects
curl might leak authentication data to third parties. When asked to send custom headers in its HTTP requests, curl sends that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the...
CVE-2018-0096
A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...
MASTER IPCAMERA01 Information Disclosure Vulnerability
MASTER IPCAMERA01 is an IP network camera product. An information disclosure vulnerability exists in MASTER IPCAMERA01 version 3.3.4.2103. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to obtain sensitive information...
PHOENIX CONTACT FL SWITCH Unauthorized Access Vulnerability
FL SWITCH is a managed Ethernet switch from the Phoenix Contact group. An unauthorized access vulnerability exists in the PHOENIX CONTACT FL SWITCH, which allows a remote, unauthenticated attacker to gain administrative privileges on the device by constructing a special HTTP request that bypasses...
PT-2018-4009 · D Link · D-Link Dsl-2640B +1
Name of the Vulnerable Software and Affected Versions: D-Link DSL-2640U versions IM 1.00 and ME 1.00 D-Link DSL-2540U version ME 1.00 Description: The issue allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request...
CVE-2018-0790
Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0789...
CVE-2018-0789
Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0790...
Microsoft ASP.NET Core Elevation of Privilege Vulnerability (CNVD-2018-00899)
Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft Corporation USA. The framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. An elevation of privilege vulnerability exists in Microsoft ASP.NET Core versio...
CVE-2017-1671
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 133638...
Microsoft SharePoint Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...
Western Digital My Cloud NAS Device Information Disclosure Vulnerability
The Western Digital MyCloud NAS is a network attached storage device. An information disclosure vulnerability exists in the Western Digital My Cloud NAS device, which allows an attacker to dump a list of all users, including detailed user information, without any authentication by sending a simpl...
undertow: improper whitespace parsing leading to potential HTTP request smuggling
It was discovered that Undertow processes http request headers with unusual whitespaces which can cause possible http request smuggling...
undertow: improper whitespace parsing leading to potential HTTP request smuggling
It was discovered that Undertow processes http request headers with unusual whitespaces which can cause possible http request smuggling...
Rapid7 Nexpose Cross-Site Request Forgery Vulnerability
Rapid7 Nexpose is a suite of vulnerability management software from Rapid7 USA that can synthesize different scans to deeply probe a network. The software proactively scans configuration environments for errors, vulnerabilities, malware and provides guidance to reduce risk. A security vulnerabili...
Embedthis GoAhead Web Server Remote Command Execution Vulnerability
Embedthis GoAhead is an embedded Web server from Embedthis Software. A remote command execution vulnerability exists in Embedthis GoAhead Web Server versions prior to 3.6.5 due to the use of HTTP request parameters when the server initializes the CGI. A remote attacker could exploit this...