PT-2024-38351 · Vivotek · Vivotek Sd9364

Name of the Vulnerable Software and Affected Versions: Vivotek SD9364 VVTK-0103f affected versions not specified Description: A critical vulnerability affects the httpd component, specifically the read function. The manipulation of the Content-Length argument leads to a stack-based buffer overflo...

PT-2024-38349 · Vivotek · Vivotek Cc8160

Name of the Vulnerable Software and Affected Versions: Vivotek CC8160 VVTK-0100d affected versions not specified Description: A critical vulnerability was found in the httpd component, specifically in the function read. The manipulation of the argument Content-Length leads to a stack-based buffer...

CVE-2024-42349

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server fogloginaccepted.log and fogloginfailed.log...

CVE-2024-42349

CVE-2024-42349 affects FOG Server versions 1.5.10.41.4 and earlier. The issue allows disclosure of authorized and rejected logins via log files created at the web root: fog_login_accepted.log and fog_login_failed.log, exposing the login username, client IP, and User-Agent. The vulnerability is mi...

CVE-2024-42349 FOG has a Log Information Disclosure

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server fogloginaccepted.log and fogloginfailed.log...

CVE-2024-42349 FOG has a Log Information Disclosure

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server fogloginaccepted.log and fogloginfailed.log...

CVE-2024-42349: Insertion of Sensitive Information into Log File

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server fogloginaccepted.log and fogloginfailed.log...

SUSE CVE-2024-41671

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1...

httpd: Substitution encoding issue in mod_rewrite

A flaw was found in the modrewrite module of httpd. Due to a substitution encoding issue, specially crafted requests may allow an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant only to be execut...

httpd: Improper escaping of output in mod_rewrite

A flaw was found in the modrewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure...

CVE-2024-33365

Buffer Overflow vulnerability in Tenda AC10 v4 USAC10V4.0siV16.03.10.20cn allows a remote attacker to execute arbitrary code via the VirtualDataCheck function in the bin/httpd component...

DEBIAN-CVE-2024-41671

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1...

UBUNTU-CVE-2024-41671

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1...

golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the...

Apache Traffic Server HTTP Request Hijacking

The vulnerability of the Apache Traffic Server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to carry out an “HTTP request hijacking” attack remotely...

PT-2024-37855 · Undefined · Undefined

"Source": "CVE FEED", "Title": "CVE-2024-6761 - CVE-2017-5618: Apache HTTP Server Cross-Site Scripting", "Content": "CVE ID : CVE-2024-6761 Published : July 29, 2024, 11:15 a.m. | 24 minutes ago Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering...

PT-2024-11759 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns a remote code execution vulnerability. No specific details about affected devices, real-world incidents, or technical exploitation details are provided...

Actiontec Wi-Fi Range Extension HTTP Server Code Execution

The vulnerability of the HTTP-server of the microprogrammed Wi-Fi range extension software Actiontec WCB6200Q is related to the use of uncontrolled format strings in processing HTTP request headers. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Apache HTTP Server Information Disclosure

The vulnerability of the Apache HTTP Server’s kernel is related to the fact that outdated handler configurations are ignored by the “AddType” feature. Exploiting this vulnerability allows a malicious actor to disclose sensitive information remotely...

Actiontec Wi-Fi Range Extension HTTP Server Code Execution

The vulnerability of the HTTP-server of the microprogrammed Wi-Fi extension software from Actiontec, WCB6200Q, is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...