CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root

Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...

PT-2025-30692 · Unknown · Network Thermostat X-Series

Name of the Vulnerable Software and Affected Versions: Network Thermostat X-Series WiFi Thermostats affected versions not specified Description: The embedded web server on the thermostat contains an issue that allows unauthenticated attackers, either on the local area network or from the Internet...

The vulnerability of the Apache HTTP Server’s web server, related to memory leaks, allows attackers to cause service interruptions.

The vulnerability of the Apache HTTP Server web server is related to a memory leak. Exploiting this vulnerability can allow an attacker to cause a service failure...

Network Thermostat X-Series WiFi thermostats 访问控制错误漏洞

Network Thermostat X-Series WiFi thermostats is a WiFi only thermostat from Network Thermostat, Inc. An access control error vulnerability exists in Network Thermostat X-Series WiFi thermostats that stems from an embedded web server that allows an unauthorized attacker to reset user credentials b...

The vulnerability of the sprintf() function in the JHTTPD web server of D-Link’s router software DI-8100 allows a hacker to execute arbitrary code.

The vulnerability of the sprintf function in the JHTTPD web server of the D-Link DI-8100 router microprogramming system is related to the execution of operations outside the buffer during the processing of the mx parameter. Exploiting this vulnerability allows a remote attacker to execute arbitra...

The vulnerability of the formLanSetupRouterSettings() function in D-Link DIR-513 router microprogramming software, a built-in web server, allows a hacker to cause a service failure.

The vulnerability of the formLanSetupRouterSettings function in the embedded web server of D-Link’s DIR-513 router software is related to the issue where data is written out of the buffer into memory when processing the curTime parameter. Exploiting this vulnerability could allow a remote attacke...

AZL-65654 CVE-2025-54090 affecting package httpd for versions less than 2.4.65-1

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

CVE-2018-25113

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter...

CVE-2018-25113 Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter...

CVE-2018-25113

Dicoogle PACS Web Server (version 2.5.0 and earlier) is affected by an unauthenticated path traversal flaw. A crafted request to the /exportFile endpoint using the UID parameter can cause the server to read arbitrary files on the underlying system, exposing sensitive data accessible to the web se...

CVE-2018-25113 Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter...

CVE-2025-8060

A vulnerability has been found in Tenda AC23 16.03.07.52 and classified as critical. Affected by this vulnerability is the function sub46C940 of the file /goform/setMacFilterCfg of the component httpd. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack ca...

PT-2025-30584 · Unknown · Dicoogle Pacs Web Server

Name of the Vulnerable Software and Affected Versions: Dicoogle PACS Web Server versions 2.5.0 and earlier Description: An unauthenticated path traversal vulnerability exists that allows remote attackers to read arbitrary files on the underlying system. Exploitation occurs by sending a crafted...

Apache 2.4.x < 2.4.65

The version of Apache httpd installed on the remote host is prior to 2.4.65. It is, therefore, affected by a vulnerability as referenced in the 2.4.65 advisory. - A bug in Apache HTTP Server 2.4.64 results in all RewriteCond expr ... tests evaluating as true. Users are recommended to upgrade to...

The vulnerability of the Web Server component of the Oracle BI Publisher software, which is used for creating reports, allows a malicious individual to gain access to read, modify, add, or delete data.

The vulnerability of the Web Server component of the Oracle BI Publisher software for creating reports is related to lack of access control measures. Exploiting this vulnerability could allow an attacker to gain read, modify, add, or delete access to data...

Apache HTTP Server 安全漏洞

Apache HTTP Server is an open source web server from the Apache Foundation USA. The server is fast, reliable, and extensible through a simple API. A security vulnerability exists in Apache HTTP Server version 2.4.64, which stems from a RewriteCond expression evaluation error that could cause all...

PT-2025-30232 · Apache +1 · Apache Web Server +1

Name of the Vulnerable Software and Affected Versions: Apache Web Server affected versions not specified Nokia WaveSuite NOC affected versions not specified Description: The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerab...

The vulnerability of Juniper Networks Junos OS web server allows a hacker to gain access to device command interfaces.

The vulnerability of Juniper Networks Junos OS web servers is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow a malicious actor to gain access to device command interfaces remotely...

D-Link DI-8100 安全漏洞

The D-Link DI-8100 is an enterprise-class router device from D-Link. A buffer overflow vulnerability exists in the D-Link DI-8100 version 1.0, which originates from the improper handling of the parameters removeextproto/removeextport by the sprintf function in the /upnpctrl.asp file of the...

CVE-2025-29009

Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Medical Prescription Attachment Plugin for WooCommerce...