Apache HTTP Server 1.2.2 - 1.3.24 / 2.0 - 2.0.36 DoS Vulnerability - Linux

Apache HTTP Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

NICER Protocol Deep Dive: Internet Exposure of HTTP and HTTPS

Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...

USN-4702-1: Pound vulnerabilities

It was discovered that Pound incorrectly handled certain HTTP requests A remote attacker could use it to retrieve some sensitive information. CVE-2016-10711, CVE-2018-21245...

Web Servers Directory Traversal Attempt (CVE-2020-10631; CVE-2020-13158; CVE-2020-13886; CVE-2020-3240)

A directory traversal vulnerability exists in web servers. Successful exploitation of this vulnerability could result in information disclosure or execution of arbitrary code...

Vulmap - Web Vulnerability Scanning And Verification Tools

Vulmap is a vulnerability scanning tool that can scan for vulnerabilities in Web containers, Web servers, Web middleware, and CMS and other Web programs, and has vulnerability exploitation functions. Relevant testers can use vulmap to detect whether the target has a specific vulnerability, and ca...

Web Servers Cross-Site Scripting Attempt (CVE-2020-10820; CVE-2020-10821; CVE-2020-11930; CVE-2020-12256; CVE-2020-12259; CVE-2020-1943; CVE-2020-2096)

Remote attackers may attempt to exploit web servers vulnerable to cross-site scripting vulnerabilities. Successful exploitation could result in damaging user systems...

RUSTSEC-2020-0093 Async-h1 request smuggling possible with long unread bodies

This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at...

HTTP Authenticated OS Command Injection (CVE-2020-17408; CVE-2020-24916; CVE-2020-25079; CVE-2020-3117; CVE-2020-7049)

A command injection vulnerability exists in web and application servers. Successful exploitation of this vulnerability could result in execution of arbitrary code on the target system...

Web Servers SQL Injection Attempt (CVE-2020-10220; CVE-2020-15533; CVE-2020-23833; CVE-2020-23973; CVE-2020-23976; CVE-2020-23978; CVE-2020-23979)

An SQL Injection vulnerability exists in web servers due to lack of input validation. Successful exploitation of this vulnerability could result in damaging target systems...

Siemens SIMATIC Controller Web Servers Denial of Service Vulnerability

Siemens SIMATIC Controller Web Servers is a platform from Siemens, Germany, that provides Web-based control for Siemens automation products. A security vulnerability in Siemens SIMATIC Controller Web Servers can be exploited by an attacker to send a specially crafted HTTP request to the product's...

Siemens SIMATIC Controller Web Servers 安全漏洞

Siemens SIMATIC Controller Web Servers is a platform from Siemens, Germany, that provides Web-based control for Siemens automation products. A security vulnerability in Siemens SIMATIC Controller Web Servers can be exploited by an attacker to send a specially crafted HTTP request to the product's...

Buffer overflow

A CWE-120: Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules see notification for details which could cause write access and the execution o...

CVE-2020-7563

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules see notification for details which could cause corruption of data, a crash, or code execution when uploading a specially crafted...

PHP < 7.3.24 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is prior to 7.3.24. It is, therefore affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

The vulnerability of the “Basic HTTP Authentication” method implemented in NPort IAW5000A-I/O Series web servers allows attackers to disclose sensitive information.

The vulnerability of the “Basic HTTP Authentication” method implemented in NPort IAW5000A-I/O Series web servers is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Researcher Demonstrates 4 New Variants of HTTP Request Smuggling Attack

A new research has identified four new variants of HTTP request smuggling attacks that work against various commercial off-the-shelf web servers and HTTP proxy servers. Amit Klein, VP of Security Research at SafeBreach who presented the findings today at the Black Hat security conference, said th...

Researcher Demonstrates 4 New Variants of HTTP Request Smuggling Attack

A new research has identified four new variants of HTTP request smuggling attacks that work against various commercial off-the-shelf web servers and HTTP proxy servers. Amit Klein, VP of Security Research at SafeBreach who presented the findings today at the Black Hat security conference, said th...

Embedthis GoAhead < 4.1.4, 5.x < 5.1.2 Replay Attack Vulnerability

Embedthis GoAhead is prone to a replay attack vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:embedthis:goahead";...

Debian: Security Advisory (DLA-2196-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2196-1] pound security update

Package : pound Version : 2.6-6+deb8u2 CVE ID : CVE-2016-10711 An issue has been found in pound, A request smuggling vulnerability was discovered in pound, a everse proxy, load balancer and HTTPS front-end for Web servers, that may allow attackers to send a specially crafted http request to a web...