19892 matches found
Default credentials
The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables...
CVE-2021-23855 Information disclosure
The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables...
CVE-2021-23855
CVE-2021-23855 affects Bosch Rexroth IndraMotion Mlc devices in multiple reports. The vulnerability arises from an exposed user/password database reachable via an unprotected web server resource, with passwords hashed using a weak hashing algorithm that could be cracked using rainbow tables. Publ...
CVE-2021-23858
CVE-2021-23858 describes an information-disclosure vulnerability affecting Bosch Rexroth IndraMotion Mlc devices. An unprotected web server resource exposes the main configuration (including users and hashed passwords) and another unprotected resource exposes device details (serial number and fir...
CVE-2021-23858 Information disclosure
Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another...
CVE-2021-23856
CVE-2021-23856 concerns the Bosch Rexroth IndraMotion Mlc web application, where a cross-site scripting vulnerability arises from lack of proper validation of client-side data by the WEB interface. This enables reflected XSS, allowing an attacker to potentially execute scripts in a user’s browser...
CVE-2021-23856 Reflected Cross-Site-Scripting
The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL...
PT-2021-4293 · Apache +1 · Apache Http Server +1
Name of the Vulnerable Software and Affected Versions: Apache HTTP Server version 2.4.49 Description: The issue is related to a null pointer dereference error during HTTP/2 request processing, which can be exploited by an external source to cause a denial of service DoS via a specially crafted...
Jetty 11.0.x < 11.0.3 Multiple Vulnerabilities
According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities: - An issue with failure to invalidate sessions after an exception in t...
Jetty 10.0.x < 10.0.3 Multiple Vulnerabilities
According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities: - An issue with failure to invalidate sessions after an exception in t...
Jetty < 9.4.41 Multiple Vulnerabilities
According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities: - An issue with failure to invalidate sessions after an exception in t...
Jetty 11.0.x < 11.0.2 Multiple Vulnerabilities
According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.39, 10.0.x prior to 10.0.2 or 11.0.x prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities: - An issue where CPU usage can reach 100% with a large invalid TLS...
Exploit for Path Traversal in Microsoft
CVE-2021-40444 Usage Ensure to run setup.sh first as yo...
Improper Input Validation in filebrowser/filebrowser
Description File Browser is a web-interface that allows you to manage and navigate through your files in a web browser. One of its features is to allow a user to run specific shell commands in the server, these commands are specified by users with administrator privileges, with an allow list. Thi...
CVE-2020-20746
A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60EN allows remote attackers to execute arbitrary code or cause a denial of service DoS via a crafted POST request to /goform/SetStaticRouteCfg...
The vulnerability of the mod_proxy module in the Apache HTTP Server allows a hacker to perform an SSRF attack.
The vulnerability of the modproxy module in the Apache HTTP Server is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
Basic auth bypass in esphome
Impact Anyone with webserver enabled and HTTP basic auth configured on 2021.9.1 or older webserver allows OTA update without checking user defined basic auth username & password Patches Patch released in 2021.9.2 Workarounds Disable/remove webserver...
CVE-2021-35027
A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information...
