19887 matches found
(0Day) Delta Industrial Automation DIAEnergie HandlerPage_KID Arbitrary File Upload Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation DIAEnergie. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
CVE-2021-24689
CVE-2021-24689 concerns the WordPress plugin Contact Forms - Drag & Drop Contact Form Builder (versions up to 1.0.5). The vulnerability is a path traversal flaw that allows high-privilege users to download arbitrary files from the web server, via the plugin’s file download feature. The core issue...
Security Bulletin: Network Intrusion Prevention System is affected by multiple Apache web server vulnerabilities (CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231)
Summary Security vulnerabilities have been discovered in the Apache web server component bundled with IBM Security Network Intrusion Prevention System. Vulnerability Details CVE-ID: CVE-2013-6438 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by an error in the modda...
Zyxel Nbg6816和Zyxel Nbg6817 跨站请求伪造漏洞
The Zyxel Nbg6816 and Zyxel Nbg6817 are both products of China's Hopkins Technology Zyxel.The Zyxel Nbg6816 is a dual-band wireless gigabit router.The Zyxel Nbg6817 is a wireless router. The Zyxel Nbg6816 and Zyxel Nbg6817 suffer from a cross-site request forgery vulnerability that stems from...
Mongoose Web Server < 7.6 File Upload Vulnerability
Mongoose Web Server is prone to an arbitrary file upload vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
VulnCheck KEV: CVE-2017-7659
A maliciously constructed HTTP/2 request could cause modhttp2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process...
VulnCheck KEV: CVE-2017-7668
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows apfindtoken to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or...
(Pwn2Own) Cisco RV340 NGINX Missing Authentication Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the NGINX web server. The issue results from...
(Pwn2Own) Cisco RV340 NGINX Improper Authentication Unrestricted File Upload Vulnerability
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Cisco RV340 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
ruby: Potential HTTP request smuggling in WEBrick
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...
WPCargo < 6.9.0 - Unauthenticated RCE
The plugin contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE PoC import sys import binascii import requests This is a magic string that when treated as pixels and compressed using the png algorithm, will cause to be written ...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25323
ZEROF Web Server 2.0 allows /admin.back XSS...
CVE-2022-25323
ZEROF Web Server 2.0 allows /admin.back XSS...
CVE-2022-25323
ZEROF Web Server 2.0 allows /admin.back XSS...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
Cross site scripting
ZEROF Web Server 2.0 allows /admin.back XSS...
