CVE-2025-60693

CVE-2025-60693 affects Linksys E1200 v2 router firmware (E1200_v2.0.11.001_us.tar.gz). The get_merge_mac function in the httpd binary concatenates up to six user-supplied CGI parameters (_0~5) into a fixed-size buffer (a2) without proper bounds checking, inserting colon delimiters during concaten...

CVE-2025-60691

The CVE-2025-60691 entry describes a stack-based buffer overflow in Linksys E1200 v2 routers (httpd: apply_cgi and block_cgi) where user input from the url parameter is copied into small stack buffers with sprintf without bounds checking. This can allow remote code execution or denial of service ...

CVE-2025-60691

A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers Firmware E1200v2.0.11.001us.tar.gz. The applycgi and blockcgi functions copy user-supplied input from the "url" CGI parameter into stack buffers v36, v29 using sprintf without bounds checking. Because these buffe...

CVE-2025-60689

CVE-2025-60689 affects Linksys E1200 v2 routers (firmware E1200_v2.0.11.001_us.tar.gz). The issue is an unauthenticated command-injection in the httpd Start_EPI function: user-supplied CGI parameters (wl_ant, wl_ssid, wl_rate, ttcp_num, ttcp_ip, ttcp_size) are concatenated into system commands an...

CVE-2025-60693

A stack-based buffer overflow exists in the getmergemac function of the httpd binary on Linksys E1200 v2 routers Firmware E1200v2.0.11.001us.tar.gz. The function concatenates up to six user-supplied CGI parameters matching 05 into a fixed-size buffer a2 without proper bounds checking, appending...

VulnCheck KEV: CVE-2022-4982

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers frame.html and frame.A100.html that accept a path parameter content or sidebar which is not properly validated or canonicalized. An attacker c...

CrushFTP 安全漏洞

CrushFTP is a file transfer server from CrushFTP, Inc. A security vulnerability exists in CrushFTP version 11.3.648, which stems from the web server file sharing feature not cleaning up filenames, and could lead to cross-site scripting attacks...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2025-2415)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-46242

CVE-2025-8768 - Apache Web Server Authentication Bypass CVE ID : CVE-2025-8768 Published : Nov. 10, 2025, 3:15 p.m. | 1 hour, 25 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-12020. Reason: This candidate is a reservation duplicate of...

FreePBX filestore authenticated command injection

This module exploits an authenticated command injection vulnerability CVE-2025-64328 in the FreePBX filestore module. The filestore module allows administrators to configure remote file storage backends SSH, FTP, etc. for backup and file management purposes. The vulnerability exists in the SSH...

From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools

A China-linked threat actor has been attributed to a cyber attack targeting an U.S. non-profit organization with an aim to establish long-term persistence, as part of broader activity aimed at U.S. entities that are linked to or involved in policy issues. The organization, according to a report...

RHSA-2025:19809 Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.3 release and security update

Bulletin has no description...

Lexmark Printers Server-Side Request Forgery (CVE-2025-9269)

A Server-Side Request Forgery SSRF vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. CVSSv4 Base Score 6.9...

The vulnerability of the Rack::Multipart::Parser class in the module interface between web servers and Rack web applications allows a attacker to cause a service failure.

The vulnerability of the Rack::Multipart::Parser class in module interfaces between web servers and Rack web applications involves an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability in the Rack::Request#POST class of the modular interface between web servers and Rack web applications allows a attacker to cause a service failure.

The vulnerability in the Rack::RequestPOST class of the modular interface between web servers and Rack web applications involves an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Lexmark Printers Improper Limitation of a Pathname to a Restricted Directory (CVE-2025-1127)

A combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503894...

Lexmark Printers Stored Cross-site Scripting (CVE-2020-13481)

A stored cross site scripting vulnerability has been identified in the embedded web server used in Lexmark devices. The vulnerability can be used to attack the user’s browser, exposing session credentials and other information accessible to the browser. %NASLMINLEVEL 80900 C Tenable, Inc...

RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 6.1.3 (RHSA-2025:19809)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19809 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...

Lexmark Printers Cross-site Request Forgery (CVE-2020-10095)

A vulnerability has been identified in the embedded web server used in Lexmark devices. The vulnerability allows the attacker to modify the configuration of the device. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503883; scriptversion"1.2";...

Lexmark Printers Improper Input Validation (CVE-2023-26068)

A vulnerability has been identified in the embedded web server used in Lexmark devices. The vulnerability allows the attacker to execute arbitrary code on a device with the permissions of the embedded webserver. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid50390...