CVE-2017-6864

The integrated web server in Siemens RUGGEDCOM ROX I all versions at port 10000/TCP could allow an authenticated user to perform stored Cross-Site Scripting attacks...

CVE-2017-6187

Disk Savvy Enterprise 9.4.18 exposes a buffer overflow in its built-in web server that can be triggered by a long URI in a GET request, potentially allowing remote code execution. This is documented across multiple sources (NVD description, SAINT background entries, and exploit references such as...

CVE-2017-5997

The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service memory consumption and process crash via multiple msgserver/group?group= requests with a crafted size of the group parameter, aka SAP Security Note 2358972...

CVE-2017-5152

An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access pages unrestricted AUTHENTICATION BYPASS...

CVE-2016-9334

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD,...

CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

mod_cluster: remotely Segfault Apache http server

It was discovered that it is possible to remotely Segfault Apache http server with a specially crafted string sent to the modcluster via service messages MCMP...

Trane Tracer SC Information Disclosure Vulnerability

The Trane Tracer SC is an intelligent control panel from Trane USA that communicates with HVAC equipment controllers. A security vulnerability exists in the web server in Trane Tracer SC 4.2.1134 and earlier versions. A remote attacker could exploit the vulnerability by sending a direct request t...

IBM HTTP Server Code Execution

The vulnerability of the Administration Server web server component of the IBM HTTP Server arises due to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Cisco Wireless LAN Controller Bypass Access Restrictions

Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to the widespread use of the Aironet IOS software. This leads to a state where the controller acts as an administrative HTTP server. Exploiting this vulnerability allows malicious actors to bypass access restrictions by...

Design/Logic Flaw

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

OS X Server Information Disclosure

The vulnerability of the Web Server component in the OS X Server operating system arises from an improper restriction on access to the .DSStore and .htaccess files. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain confidential configuration information through...

Apple OS X Server Web Server Unauthorized Operation Vulnerability

Apple OS X Server is a set of Unix-based server operating software from the U.S. company Apple Apple. The software can realize file sharing, meeting arrangement, website hosting, network remote access, etc. Web Server is one of the Web servers. A security vulnerability exists in Apple OS X Server...

SAUTER moduWeb Vision Arbitrary Code Injection

The vulnerability of the BACnet/IP network controller visualization web server from SAUTER moduWeb Vision exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially craft...

http-vuln-cve2013-6786 NSE Script

Detects a URL redirection and reflected XSS vulnerability in Allegro RomPager Web server. The vulnerability has been assigned CVE-2013-6786. The check is general enough script tag injection via Referer header that some other software may be vulnerable in the same way. See also:...

Micrologix PLC Injection

The vulnerability of Micrologix 1100 and 1400 microprogrammed logic controllers’ web servers exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code remotely...

JSPMySQL Administrador Cross-Site Scripting Vulnerability

JSPMySQL Administrador is a JSP technology Web server MySQL database remote management tools . JSP/MySQL Administrador Web 1 in the implementation of a cross-site scripting vulnerability , remote attackers through the sys/sys/listaBD2.jsp bd parameter , the use of this vulnerability can be inject...

FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state

Problem Description: TCP connections transitioning to the LASTACK state can become permanently stuck due to mishandling of protocol state in certain situations, which in turn can lead to accumulated consumption and eventual exhaustion of system resources, such as mbufs and sockets. Impact: An...

Siemens Simatic S7-1200 PLC Inter-site Fraudulently Manipulation

The software of the programmable logic controller Simatic S7-1200 contains a vulnerability in its built-in server port 80 TCP and port 443 TCP. Exploiting this vulnerability allows for inter-site request forgery attacks...

IBM Lotus Domino Web Server Webmail Cross-Site Scripting Vulnerability

The IBM Lotus Domino server is a WEB-based collaborative application architecture. A cross-site scripting vulnerability exists in the webmail interface of IBM Lotus Domino Web Server, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be us...