44 matches found
EUVD-2025-35333
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified...
EUVD-2021-14176
Malware in sbrugna...
EUVD-2024-2325
Malicious code in bioql PyPI...
CVE-2025-58068 Eventlet affected by HTTP request smuggling in unparsed trailers
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted...
GHSA-HW6F-RJFJ-J7J7 Eventlet affected by HTTP request smuggling in unparsed trailers
Impact The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to: - Bypass front-end security controls - Launch targeted attacks against active site users - Poison web caches Patches Problem has...
python-gevent: privilege escalation via a crafted script to the WSGIServer component
A flaw was found in python-event, which could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the WSGIServer component. By using a specially crafted script, an attacker can gain elevated privileges...
python-gevent: privilege escalation via a crafted script to the WSGIServer component
A flaw was found in python-event, which could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the WSGIServer component. By using a specially crafted script, an attacker can gain elevated privileges...
CVE-2024-35231 rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...
CVE-2024-25126
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability ReDos 2nd degree polynomial. This vulnerability is patched in 3.0.9.1 and 2.2.8.1...
CVE-2024-25126 Rack ReDos in content type parsing (2nd degree polynomial)
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability ReDos 2nd degree polynomial. This vulnerability is patched in 3.0.9.1 and 2.2.8.1...
PYSEC-2023-177
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component...
PT-2023-18802
Name of the Vulnerable Software and Affected Versions Lexmark products through 2023-01-10 Description The issue is related to Improper Control of Interaction Frequency in Lexmark products. It affects the built-in web server interface of more than 60 Lexmark printer models, specifically concerning...
GMAO LINX LINX Sphere 路径遍历漏洞
GMAO LINX LINX Sphere is a software from GMAO LINX designed for the overall management of industrial and construction grade maintenance departments. A security vulnerability exists in GMAO LINX LINX Sphere version 7.35.ST15, which stems from a directory traversal in the component...
The vulnerability of the WSGI server for Python Waitress allows attackers to compromise data integrity.
The vulnerability of the WSGI server for Python Waitress is related to an incorrect analysis of the Transfer-Encoding header. Exploiting this vulnerability allows a remote attacker to compromise data integrity...
CVE-2021-27422
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication...
CVE-2021-27422: Exposure of Sensitive Information to an Unauthorized Actor
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication...
Realtek Jungle SDK 安全漏洞
The Realtek Jungle SDK from China's Realtek Semiconductor Realtek provides an HTTP web server that exposes a management interface that can be used to configure access points. A security vulnerability exists in the Realtek Jungle SDK, which stems from a failure of the product's configuration...
CVE-2020-7208
LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2...
Waitress Environment Issue Vulnerability
Waitress is a WSGI Web Server Gateway Interface server for Python. An environmental issue vulnerability exists in Waitress 1.4.0 and earlier versions. The vulnerability stems from an unreasonable environmental factor in a networked system or product. An attacker could exploit this vulnerability t...
PT-2018-3939 · Cisco · Asa 5500-X Series Next-Generation Firewalls +6
Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified 3000 Series Industrial Security Appliances affected versions not specified Adaptive Security Virtual Appliance ASAv affected versions not specified ASA 5500 Series...