CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

HTTP Request Smuggling

Overview std/net/http/httputil is a Go standard library package std/net/http/httputil Affected versions of this package are vulnerable to HTTP Request Smuggling. Go Vulnerability Report:Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

The vulnerability of Mozilla Firefox browser and the Thunderbird email client relates to deficiencies in HTTP request processing, allowing attackers to execute arbitrary JavaScript code.

The vulnerability of the Mozilla Firefox browser and the Thunderbird email client is related to deficiencies in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service failures, bypass security restrictions, access confidential information, or execute...

PT-2022-5100 · Cisco · Cisco Jabber

Name of the Vulnerable Software and Affected Versions: Cisco Jabber affected versions not specified Description: A vulnerability in the Extensible Messaging and Presence Protocol XMPP message processing feature could allow an authenticated, remote attacker to manipulate the content of XMPP...

CVE-2022-39268 orchest vulnerable to cross-site request forgery that allows control of a user instance

Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user...

CVE-2022-39268 orchest vulnerable to cross-site request forgery that allows control of a user instance

Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user...

UBUNTU-CVE-2022-41317

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7...

CVE-2022-38333

Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function headervalue. This vulnerability allows attackers to access sensitive information via a crafted HTTP request...

The vulnerability of the Python Waitress server, related to HTTP request processing flaws, allows attackers to compromise data integrity.

The vulnerability of the Python-based Waitress server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

Design/Logic Flaw

A local file inclusion LFI vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service DoS or access sensitive server information via manipulation of the getpage parameter in a crafted web request...

CVE-2022-38258

A local file inclusion LFI vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service DoS or access sensitive server information via manipulation of the getpage parameter in a crafted web request...

CVE-2022-38258

The CVE-2022-38258 vulnerability affects D-Link DIR-819 (firmware v1.06) through a local file inclusion (LFI) in the web interface via the getpage parameter. The underlying issue allows an attacker to trigger a Denial of Service or access sensitive server information by crafting a crafted request...

Jitsi 安全漏洞

Jitsi is a free open source audio/video and chat communicator from Jitsi Open Source. A security vulnerability exists in the Jitsi jitsi-2.10.5550 version that stems from the inclusion of an issue in its Web UI that allows an attacker to perform a clickjacking attack via a crafted HTTP request...

CVE-2022-31414

D-Link DIR-1960 firmware DIR-1960A11.11 was discovered to contain a buffer overflow via srtcat in prog.cgi. This vulnerability allowed attackers to cause a Denial of Service DoS via a crafted HTTP request...

CVE-2022-2466

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior...

The vulnerability of the API interface of the code deployment, management, and collaboration tool based on Git Bitbucket Server and Data Center allows a hacker to execute arbitrary code.

The vulnerability of the API interface for code deployment, management, and collaboration based on Git Bitbucket Server and Data Center is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted HTTP...

CVE-2022-35191

D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service DoS via a crafted HTTP connection request...

D-Link AC1200 安全漏洞

The D-Link AC1200 is a router from China-based AUO D-Link. A security vulnerability exists in the D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 firmware version v1.01, which originates from a denial of service that can be exploited by an unauthenticated attacker via a crafted...