Moxa EDR-810 Cross-Site Request Forgery Vulnerability

The EDR-810 is a highly integrated industrial multi-port security router with firewall/NAT/VPN and two-layer manageable switch functionality. A cross-site request forgery vulnerability exists in the web server functionality of the Moxa EDR-810 V4.1 build 17030317. An attacker can exploit this...

CVE-2017-14433

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetwork0= parameter in the...

CVE-2017-12120

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation, resulting in a root shell. An attacker can inject OS commands into the ip= parm in the...

CVE-2017-14437

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXA\LOG.ini" without a cookie heade...

undertow: improper whitespace parsing leading to potential HTTP request smuggling

It was discovered that Undertow processes http request headers with unusual whitespaces which can cause possible http request smuggling...

RLE Wi-MGR/FDS-Wi Web Server Cross-Site Scripting Vulnerability

RLE Wi-MGR/FDS-Wi is a wireless monitoring device. web server is a web server used in it. A cross-site scripting vulnerability exists in the web server of the RLE Wi-MGR/FDS-Wi version 6.2. A remote attacker can exploit this vulnerability to inject malicious JavaScript code via the device's BACne...

CVE-2018-7561

Stack-based Buffer Overflow in httpd on Tenda AC9 devices V15.03.05.14EN allows remote attackers to cause a denial of service or possibly have unspecified other impact...

Multiple Products Web Server Component Privilege Gain Vulnerability

Dup Scout Enterprise is a file wiping tool.Disk Savvy Enterprise is a hard disk space analysis tool.Sync Breeze Enterprise is a file synchronization tool.Disk Pulse Enterprise is a disk inspection tool. A security vulnerability exists in the web server component of multiple products that stems fr...

CVE-2018-5071

Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaScript code using the device's TELNET shell built-in commands, as demonstrated by the "set ship name" command. This is similar to a Cross...

TIBCO tibbr web server component improper vulnerability

TIBCO tibbr is a set of enterprise social platform software from TIBCO Software. The software includes features for posting news, making announcements, and sharing online. tibbr web server is one of the web server components. A security vulnerability exists in the tibbr web server component of...

Unitrends Enterprise Backup Root Privilege

The vulnerability of the web server of the Unitrends Enterprise Backup software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to obtain root privileges by modifying the cookie file issued upon system login...

Privilege escalation

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server...

Brother DCP-J132W Denial of Service Vulnerability

Brother DCP-J132W is a printer introduced by Brother. A denial of service vulnerability exists in httpd embedded in the Brother DCP-J132W, which allows a remote attacker to cause the printer to hang disrupting its network connection by sending a large number of HTTP packets...

fli4l HTTP header injection vulnerability

fli4l is a Linux-based ISDN, DSL and Ethernet router product developed by the fli4l team, which can be configured via ASCII files and supports multiple connection methods, displaying and calculating connection times and costs, monitoring traffic and monitoring ISDN calls. An HTTP header injection...

Remote File Inclusion

Magento is vulnerable to remote file inclusion. The vulnerability is possible because the fetchView function in the MageCoreBlockTemplateZend class does not enforce security mechanisms, allowing an authenticated administrator to execute arbitrary PHP code on the web server...

Unspecified Vulnerability in Oracle Fusion Middleware BI Publisher (CNVD-2017-17502)

Oracle Fusion Middleware is a comprehensive middleware product family consisting of SOA and middleware products.BI Publisher is one of the reporting components. A security vulnerability exists in the Web Server component implementation of Oracle BI Publisher version 11.1.1.7.0, which can be...

Unspecified Vulnerability in Oracle Fusion Middleware BI Publisher (CNVD-2017-17501)

Oracle Fusion Middleware is a comprehensive middleware product family consisting of SOA and middleware products.BI Publisher is one of the reporting components. Oracle BI Publisher version 11.1.1.7.0 contains a security vulnerability in the implementation of the Web Server component, which can be...

httpd: Padding Oracle in Apache mod_session_crypto

It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...

CVE-2016-8723

CVE-2016-8723 affects Moxa AWK-3131A Wireless Access Point (firmware 1.1). A null pointer dereference in the Web Application can be triggered by HTTP GET requests not starting with ‘/’, causing the web server to segfault (Denial of Service). Reported CVSS around 7.5 (HIGH). Exploitation details e...

LAquis SCADA Software Web Server Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. Authentication is not required to exploit this vulnerability. The specific flaw exists within global processing of requests inside the web server. The issue results...