CVE-2022-25940

All versions of package lite-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

Mozilla Firefox Memory Corruption Vulnerability (CNVD-2023-75349)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A memory corruption vulnerability exists in Mozilla Firefox, which can be exploited by a remote attacker to submit a specially crafted web request that the user can be induced to parse, which can cause...

CVE-2022-32573

A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-32763

A cross-site scripting xss sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-29517

A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-28703

A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A memory corruption vulnerability exists in Mozilla Firefox, which can be exploited by a remote attacker to submit a specially crafted web request that the user can be induced to parse, which can cause...

Input validation

Due to insufficient input validation, SAP NetWeaver AS Java HTTP Provider Service - version 7.50, allows an unauthenticated attacker to inject a script into a web request header. On successful exploitation, an attacker can view or modify information causing a limited impact on the confidentiality...

CVE-2022-41262

Due to insufficient input validation, SAP NetWeaver AS Java HTTP Provider Service - version 7.50, allows an unauthenticated attacker to inject a script into a web request header. On successful exploitation, an attacker can view or modify information causing a limited impact on the confidentiality...

CVE-2022-41262

CVE-2022-41262 affects SAP NetWeaver AS Java (HTTP Provider Service), version 7.50. The issue is due to insufficient input validation that allows an unauthenticated attacker to inject a script into a web request header. The resulting impact is described as limited in confidentiality and integrity...

The vulnerability of the API interface of the Redfish microprogramming software for remote control controllers AMI MegaRAC allows a perpetrator to execute arbitrary code.

The vulnerability of the API interface of the microprogramming software for AMI MegaRAC controllers is related to errors during code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP request...

Fortinet FortiADC 输入验证错误漏洞

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. An input validation error vulnerability exists in Fortinet FortiADC, which stems from improper input validation of the application and could be exploited by an authenticated attacker to retrieve a file with a specific...

Lansweeper 路径遍历漏洞

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A path traversal vulnerability exists in Lansweeper version 10.1.1.0, which stems from the presence of a path than there, a specially crafted...

Lansweeper 路径遍历漏洞

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A path traversal vulnerability exists in Lansweeper version 10.1.1.0, which stems from the presence of a path than there, a specially crafted...

IBM DB2 跨站请求伪造漏洞

IBM DB2 is a relational database management system from International Business Machines IBM. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM Db2 versions 3.5, 4.0, and 4.5 are vulnerable to cross-site request forgery, which stems from WEB...

The vulnerability of the SetDdns-userName component in the Reolink RLC-410W camera’s microprogramming system allows a intruder to execute arbitrary commands.

The vulnerability of the SetDdns-userName component in the Reolink RLC-410W camera’s microprogramming system exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitra...

CVE-2022-45921

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...

PT-2022-27687 · Unknown · Fusionauth

Name of the Vulnerable Software and Affected Versions: FusionAuth versions prior to 1.41.3 Description: The issue allows an attacker to view or retrieve files outside of the application root using an HTTP request. Specifically, an attacker may be able to access any file readable by the user runni...

CVE-2022-39833

FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request...

The vulnerability of Websoft HCM’s automation software for HR processes stems from improper code generation management, allowing attackers to execute arbitrary code.

The vulnerability of Websoft HCM’s automation software for HR processes is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code during the generation of HTTP requests...