CVE-2020-0693

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0694...

CVE-2020-0694

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693...

Cross site scripting

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693...

Cross site scripting

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0694...

CVE-2020-0694

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693...

CVE-2020-0693

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0694...

The vulnerability of the ajaxArchiveFiles.php component, a utility for managing the configuration of rConfig network devices, allows an attacker to execute arbitrary commands on the target system.

The vulnerability of the ajaxArchiveFiles.php component, a utility for managing the configuration of rConfig network devices, is related to errors in handling HTTP requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by sending...

Security Updates for Microsoft SharePoint Server (February 2020)

The Microsoft SharePoint Server installation on the remote host is missing security updates. It is, therefore, affected by a cross-site scripting vulnerability. A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web...

PT-2020-6483

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.25.9 Description The issue is related to insufficient neutralization of special elements in the HTTP request method, which can lead to CRLF injection if the attacker controls the HTTP request method. This can be...

PT-2020-6266 · Python +10 · Python +10

Name of the Vulnerable Software and Affected Versions: Python versions 3.x before 3.5.10 Python versions 3.6.x before 3.6.12 Python versions 3.7.x before 3.7.9 Python versions 3.8.x before 3.8.5 Description: The issue is related to a lack of output encoding or escaping mechanism in Python's HTTP...

ALPINE-CVE-2019-15605

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...

Remote code execution

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch,...

The vulnerability of the SAP UI5 software-based HTTP handler allows attackers to compromise the integrity of protected information.

The vulnerability of the SAP UI5 software application’s HTTP handler is related to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protected information...

USN-4235-1 nginx vulnerability

Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain errorpage configurations. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks and access resources contrary to expectations...

ALPINE-CVE-2019-20372

NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer...

CVE-2013-5657

AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request...

rConfig Remote Code Execution Vulnerability

rConfig is an open source network configuration management utility . A security vulnerability exists in rConfig version 3.9.3, which originates from the program failing to filter before passing the 'path' parameter directly to the 'exec' function. The vulnerability can be exploited by a remote...

The vulnerability of the microprogrammed software of Cisco Small Business RV016, Cisco Small Business RV042, Cisco Small Business RV042G, and Cisco Small Business RV082 is related to authentication errors, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of Cisco Small Business RV016, Cisco Small Business RV042, Cisco Small Business RV042G, and Cisco Small Business RV082 microprogrammed software routers is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

CVE-2019-3995

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash the ELOG server by sending a crafted HTTP GET request...