CVE-2023-4492

Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to...

WithSecure products Security breaches

WithSecure products is a series of security software from the Finnish company WithSecure. A security vulnerability exists in WithSecure Policy Manager 15, Policy Manager Proxy version 15, which originates from a vulnerability that allows execution of unauthenticated remote code via a web server...

CVE-2022-47556

CVE-2022-47556 describes uncontrolled resource consumption in Ormazabal ekorRCI . A low-privileged attacker with network access can send continuous, legitimate web requests to a function that is not properly validated, causing a Denial of Service (DoS) on the device. The vulnerability affects eko...

PT-2023-28796 · Broadcom · Broadcom Raid Controller Web Server

Name of the Vulnerable Software and Affected Versions: Broadcom RAID Controller Web server nginx affected versions not specified Description: The issue concerns the Broadcom RAID Controller Web server, which is based on nginx and is serving private server-side files without any authentication on...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS in Kestrel where, on detecting a...

The vulnerability of the httpd component of the microprogramming software for Wi-Fi routers from ASUS, ASUS RT-AX88U, allows a hacker to trigger a service failure.

The vulnerability of the httpd component of the microprogramming-based Wi-Fi router software from ASUS, the RT-AX88U, exists due to insufficient testing of input data. Exploiting this vulnerability could allow a remote attacker to execute a “denial-of-service” attack...

The vulnerability of the Spectrum Power software-based web server allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Spectrum Power software web server relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created malicious link...

HiSecOS 04.0.01 - Privilege Escalation

Exploit Title: HiSecOS 04.0.01 - Privilege Escalation Google Dork: HiSecOS Web Server Vulnerability Allows User Role Privilege Escalation Date: 21.06.2023 Exploit Author: dreizehnutters Vendor Homepage:...

CVE-2022-38156

A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband NB before 1.7.5. As an admin user, an attacker can send a crafted password in order to execute Linux commands as the root user...

CVE-2022-38156

A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband NB before 1.7.5. As an admin user, an attacker can send a crafted password in order to execute Linux commands as the root user...

CVE-2023-31240

Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials...

Denial of Service Vulnerability in Multiple Siemens Products (CNVD-2023-35758)

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...

CVE-2023-27747

BlackVue DR750-2CH LTE v.1.0122022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information such as configurations and recordings...

The vulnerability of the web server of the microprogramming software for the processor module controllers Siemens SICAM CP-8031 and CP-8050 allows a hacker to execute arbitrary commands.

The vulnerability of the web server of the microprogramming software for the processor module controllers Siemens SICAM CP-8031 and CP-8050 is related to insufficient checking of the arguments passed in the command. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

Siemens SIMATIC CP443-1 OPC UA9 安全漏洞

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...

The vulnerability of Hirschmann EAGLE’s web server allows attackers to enhance their privileges.

The vulnerability of the Hirschmann EAGLE industrial Ethernet switches involves errors in the processing of input data. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

SUSE CVE-2006-3918

httpprotocol.c in 1 IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and 2 Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site...

SUSE CVE-2011-1928

The fnmatch implementation in aprfnmatch.c in the Apache Portable Runtime APR library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service infinite loop via a URI that does not match unspecified types of wildcard patterns, as demonstrated by...

The vulnerability of the httpd microprogramming software used in TOTOLINK A7100RU routers allows attackers to execute arbitrary commands.

The vulnerability of the httpd microprogramming system used in TOTOLINK A7100RU routers lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

JSA10374 - Pulse Connect Secure (PCS) SSL VPN Webroot Path Disclosure Vulnerability

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. By requesting the 'remediate.cgi' script omitting certain parameters, the embedded PCS web server returns the physical path of the webroot '/home/webserver/htdocs/' within an "Execute...