The vulnerability of the NPort IAW5000A-I/O Series web server software lies in its lack of access control mechanisms, allowing attackers to send arbitrary requests to the vulnerable system.

The vulnerability of the NPort IAW5000A-I/O Series web server software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to send arbitrary requests to the vulnerable system remotely...

CVE-2020-13174

The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking...

Privilege Escalation

pdns-recursor is vulnerable to privilege escalation. The vulnerability exists as pdns-recursor does not properly restrict ACL access to the internal web server...

Siemens SICAM MMU, SICAM T, and SICAM SGU

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SICAM MMU, SICAM T and SICAM SGU Vulnerabilities: Out-of-bounds Read, Missing Authentication for Critical Function, Missing Encryption of Sensitive Data, Use of Password Hash wit...

tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instance...

undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS

A vulnerability was found in the Undertow HTTP server listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service DOS to make the service unavailable on SSL...

Buffer overflow vulnerability in multiple Tenda products (CNVD-2020-31409)

The Tenda AC9, among others, is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in httpd in several Tenda products. The vulnerability can be exploited to execute arbitrary code by sending the 'list' parameter to the /goform/SetNetControlList URL...

CVE-2020-13391

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19multiTD01, AC9 V1.0 V15.03.05.196318CN, AC9 V3.0 V15.03.06.42multi, AC15 V1.0 V15.03.05.19multiTD01, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the...

CVE-2020-13392

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19multiTD01, AC9 V1.0 V15.03.05.196318CN, AC9 V3.0 V15.03.06.42multi, AC15 V1.0 V15.03.05.19multiTD01, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the...

CVE-2020-13390

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19multiTD01, AC9 V1.0 V15.03.05.196318CN, AC9 V3.0 V15.03.06.42multi, AC15 V1.0 V15.03.05.19multiTD01, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the...

CVE-2020-3161

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service DoS condition. The vulnerability is due to a lack of proper input validation of HT...

Arbitrary Code Execution

squirrelmail is vulnerable to arbitrary code execution. A local file disclosure flaw was found in the way SquirrelMail loads plugins. If registerglobals is on and magicquotesgpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web...

The vulnerability of Engine.IO’s WebSocket server protocol, related to the manipulation of cross-site requests, allows attackers to perform arbitrary actions on the vulnerable system.

The vulnerability of the WebSocket protocol in the Engine.IO web server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable system remotely...

CVE-2019-9101

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. Sensitive information is sent to the web server in cleartext, which may allow an attacker to discover the credentials if they...

Cross-Site Scripting Vulnerability in Multiple Lexmark Products

The Lexmark CS31x, among others, is a printer from Lexmark USA. A cross-site scripting vulnerability exists in the web server built into several Lexmark products, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

Cross-site scripting vulnerability in multiple Lexmark products (CNVD-2020-19522)

The Lexmark CS31x, among others, is a printer from Lexmark USA. A cross-site scripting vulnerability exists in the web server built into several Lexmark products, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300’s web servers allows attackers to execute cross-site scripting attacks.

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300 relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2011-3596

Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request...

Siemens Desigo PX 6.00 - Denial of Service (PoC)

Title: Siemens Desigo PX 6.00 - Denial of Service PoC Author: LiquidWorm Date: 2019-11-14 Vendor web page: https://www.siemens.com Product web page: https://new.siemens.com/global/en/products/buildings/automation/desigo.html Affected version:6.00 Affected version: Model: PXC00-E.D, PXC50-E.D,...

PT-2019-6021

Name of the Vulnerable Software and Affected Versions Modicon Controllers versions affected versions not specified Description A vulnerability exists in Modicon Controllers, which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure...