CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...

Microsoft ASP.NET Core Denial of Service Vulnerability (CNVD-2020-16652)

Microsoft ASP.NET Core is a framework of cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web applications, Internet of Things applications, and mobile backends. A denial of service vulnerability exists in Microsoft ASP.NET Core...

CVE-2020-7241

The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 20200..10..20..30..9 format, guessing UNIX...

CVE-2020-2560

Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM component: SWSE Server. Supported versions that are affected are 19.10 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attac...

CVE-2020-0656

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

Denial of service

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'...

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

PT-2020-1295 · Microsoft +2 · Asp.Net Core +2

Name of the Vulnerable Software and Affected Versions: ASP.NET Core affected versions not specified Description: A denial of service issue exists due to improper handling of web requests by ASP.NET Core. This can be exploited by a remote attacker to cause a denial of service by sending specially...

nginx 0.8.x < 0.8.33 / 0.7.x < 0.7.65 Windows Filename Pseudonyms (CORE-2010-0121)

The installed version of nginx is 0.7.52 and prior to 0.7.65, or 0.8.x prior to 0.8.33. It is, therefore, affected by a flaw in Windows installations of nginx. This is due to nginx mishandling DOS-compatible 8.3 short filenames. An unauthenticated, remote attacker can exploit this, via web...

The vulnerability of the microprogrammed Ethernet switch software from Moxa series EDS-405A lies in insufficient validation of input data, allowing a intruder to trigger a service failure.

The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending HTTP GET requests to the vulnerable device...

The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series, related to buffer overflow, allows a hacker to trigger a service failure.

The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by sending HTTP GET requests to the vulnerable device...

Cisco Data Center Network Manager serverinfo Hardcoded Password Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Data Center Network Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of web requests. The system contains a hard-cod...

The vulnerability of the McAfee Advanced Threat Defense software arises from the lack of measures taken to neutralize its special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the McAfee Advanced Threat Defense security tool exists due to the failure to take measures to neutralize specific elements within it. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands by sending specially crafted HTTP...

The vulnerability of the “/absolute/pathname/here” component of the McAfee Advanced Threat Defense security tool, which allows a perpetrator to gain access to files in the local file system.

The vulnerability of the “/absolute/pathname/here” component of the McAfee Advanced Threat Defense security tool exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to...

The vulnerability of the HTTP-server of the microprogramming-based VPN router TP-Link TL-R600VPN allows a intruder to gain unauthorized access to protected information.

The vulnerability of the HTTP server of the microprogrammed VPN router TP-Link TL-R600VPN relates to incorrect path name restrictions for restricted access directories. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information ...

CVE-2019-13932

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web application requests could be manipulated, causing the the application to behave in unexpected ways for legitimate users. Successful exploitation does not require for an attacker to be authenticated. A successful attack cou...

The vulnerability of the WEBrick library for the Ruby programming language allows attackers to trigger a service failure.

The vulnerability of the WEBrick library for the Ruby programming language is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using specially crafted HTTP requests...

CVE-2019-19642

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or...

CVE-2019-5110

Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

CVE-2019-5109

Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...