22234 matches found
CVE-2024-32966
Static Web Server SWS is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code...
CVE-2023-46295
An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sending a POST request to the vulnerable PHP page. An attacker can elevate to root permissions with Sudo...
PT-2024-13349 · Teledyne Flir · Teledyne Flir M300
Name of the Vulnerable Software and Affected Versions: Teledyne FLIR M300 versions 2.00 through 2.00-19 Description: An issue was discovered in the web server of the affected software, allowing unauthenticated remote code execution. This can be exploited by sending a POST request to the vulnerabl...
Static Web Server security vulnerabilities
Static Web Server is a static web server from the German company Static Web Server. A security vulnerability exists in Static Web Server SWS versions 2.28.0 and earlier that originates from a vulnerability that allows an attacker to upload a malicious filename to execute JavaScript code in the we...
CVE-2024-32966: Improper Neutralization of Input During Web Page Generation
Static Web Server SWS is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code...
CVE-2023-46295
Unauthenticated remote code execution can occur in the web server of Teledyne FLIR M300 (versions 2.00 through 2.00-19). An attacker can exploit this by sending a POST request to a vulnerable PHP page , which may allow for privilege elevation to root permissions via Sudo. Remediation includes dis...
CVE-2024-2377
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information...
CVE-2024-2377
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information...
CVE-2024-2377
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information...
httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure
A vulnerability was found in Apache Tomcat Connectors modjk. Affected versions of this package are vulnerable to information exposure in the modjk component. This flaw allows an attacker to exploit the implicit mapping functionality, resulting in the unintended exposure of the status worker and...
CVE-2024-32966
creationtimestamp| type| source ---|---|--- 2024-04-30 09:02:01+00:00| published-proof-of-concept| https://github.com/static-web-server/static-web-server/security/advisories/GHSA-rwfq-v4hq-h7fg...
Hitachi Energy SDM600 security vulnerability
Hitachi Energy SDM600 is a system data manager from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Energy SDM600, which arises from an overly liberal HTTP response header web server setting that allows an attacker to perform privileged operations and access sensitive...
PT-2024-25013 · Unknown · Static Web Server
Name of the Vulnerable Software and Affected Versions: Static Web Server SWS affected versions not specified Description: The issue allows JavaScript code execution in the context of the web server's domain when directory listings are enabled for a directory that an untrusted user has upload...
Hitachi Energy RTU500 Series Product (Update B)
SUMMARY Hitachi Energy is aware of the vulnerability CVE-2024-2617 in the RTU500 Web server component, that affects the RTU500 versions that are listed below. An attacker successfully exploiting this vulnerability could bypass secure update. Please refer to the Recommended Immediate Actions for...
CVE-2024-32491
An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file via a manipulated AJAX Request to an arbitrary writable location by traversing paths. Arbitrary code can be executed if this location is publicly available...
USN-6729-3 apache2 vulnerabilities
USN-6729-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Orange Tsai discovered that the Apache HTTP Server incorrectly handled validating certain input. A remote attacker could possibly use this issue ...
PT-2024-3641 · Unknown · Fluent-Bit
Name of the Vulnerable Software and Affected Versions: Fluent Bit versions 2.0.7 through 3.0.3 Description: A memory corruption vulnerability in Fluent Bit's embedded HTTP server allows an unauthenticated attacker to potentially execute arbitrary code, cause a denial of service, or disclose...
CVE-2024-32491
An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file via a manipulated AJAX Request to an arbitrary writable location by traversing paths. Arbitrary code can be executed if this location is publicly available...
CVE-2024-32491
A path traversal vulnerability exists in Znuny and Znuny LTS versions 6.0.31 through 6.5.7 and 7.0.1 through 7.0.16 . A logged-in user can exploit this issue by sending a manipulated AJAX Request to upload a file to an arbitrary writable location. If the targeted location is publicly accessible v...
