ALPINE-CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

CVE-2018-18708

An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function...

Buffer overflow

An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceList' parameter for a post request,...

Buffer overflow

An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceMac' parameter for a post request,...

The vulnerability of the HTTP-server on the RouterOS operating system of MikroTik allows a hacker to cause a service failure.

The vulnerability of the HTTP server of the RouterOS operating system for MikroTik devices stems from the exhaustion of available memory during the loading of a file. Exploiting this vulnerability allows an attacker to cause a malfunction or a reboot of the device through a specially crafted HTTP...

CVE-2018-18706

CVE-2018-18706 affects Tenda AC7/AC9/AC10/AC15/AC18 routers. The vulnerability exists in the router’s web server (httpd) where, on processing the page parameter of the function fromDhcpListClient , the value is directly used in a sprintf into a stack-based local variable, overriding the function’...

CVE-2018-18258

An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...

The vulnerability of Siemens SCALANCE X300 industrial switches’ web servers allows a hacker to trigger a service failure.

The vulnerability of Siemens SCALANCE X300 industrial switches involves insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to trigger service interruptions by sending specially crafted packets to the TCP port 443...

CVE-2018-16282

A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/netWebCADELETEGetValue URI...

The vulnerability of the built-in web server of Schneider Electric’s Modicon Premium, Modicon Quantum PLC, Modicon M340, and Modicon BMXNOR0200 allows a perpetrator to execute arbitrary code.

The vulnerability of Schneider Electric Modicon BMXNOR0200 embedded web servers is related to an error in HTTP request analysis. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the web server using specially crafted HTTP requests...

CVE-2018-12981

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be...

CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

Reliable Controls MACH-ProWebCom Information Disclosure Vulnerability

The Reliable Controls MACH-ProWebCom is a building controller from Canada's Reliable Controls that supports custom programming and has a built-in web server. A security vulnerability exists in Reliable Controls MACH-ProWebCom version 7.80. A remote attacker can exploit the vulnerability by sendin...

CVE-2018-4842

CVE-2018-4842 affects Siemens SCALANCE X switches (X-200, X-200 IRT, X-300; incl. SIPLUS NET) with HRP enabled, allowing remote, authenticated attackers with access to the configuration web server to store script code (XSS) in the hosted web page. Affected versions: X-200 < v5.2.3 (note: CVE-2...

CVE-2018-10088

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725...

section2.madisonjbrooks12 Directory Traversal Vulnerability

section2.madisonjbrooks12 is a simple web server. A directory traversal vulnerability exists in section2.madisonjbrooks12. An attacker can cause a directory traversal vulnerability by placing the ". /" in a URL to access the file system...

zwserver directory traversal vulnerability

zwserver is a web server. A directory traversal vulnerability exists in zwserver. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

CVE-2017-16192

getcityapi.yoehoehne is a web server. getcityapi.yoehoehne is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Directory traversal

section2.madisonjbrooks12 is a simple web server. section2.madisonjbrooks12 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16110

weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...