Siemens OZW Web Server Code Execution and SQL Injection Vulnerabilities (CNVD-2025-10579 )

The OZW device web server is used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning status. A code execution and SQL injection vulnerability exists in the Siemens OZW672 and OZW772 web servers, which can be exploited by an attacker to...

PT-2025-20896 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Web Server affected versions not specified Description: The issue concerns an information disclosure problem. No specific technical details about exploitation are provided, such as API endpoints, vulnerable parameters, or function...

CVE-2025-4544

A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument defmax/deftime/deftcpmax/deftcptime/defudpmax/defudptime/deficmpmax leads to...

RHSA-2025:4521 Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.4 release and security update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.4 release and security update

An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.4 release and security update

Red Hat JBoss Web Server 5.8.4 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CV...

RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.8.4 (RHSA-2025:4521)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4521 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of...

CVE-2025-46727

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with...

CVE-2025-32441

Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the Rack::Session::Pool middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the...

CVE-2025-32441 Rack session gets restored after deletion

Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the Rack::Session::Pool middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the...

CVE-2025-47550

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio allows Upload a Web Shell to a Web Server. This issue affects Instantio: from n/a through 3.3.16...

PT-2025-20315 · Nginx +10 · Nginx +10

Name of the Vulnerable Software and Affected Versions: Rack versions prior to 2.2.14, 3.0.16, and 3.1.14 Description: Rack is a modular Ruby web server interface. The Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any...

libsoup: Out of bounds reads in soup_headers_parse_request()

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

The vulnerability of CommVault’s backup and disaster recovery web server allows a perpetrator to execute arbitrary code.

The vulnerability of CommVault’s backup and disaster recovery web server lies in the deficiencies in the mechanism for verifying input data. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2025-3927

Digigram's PYKO-OUT audio-over-IP AoIP web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices...

CVE-2025-3927

Digigram's PYKO-OUT audio-over-IP AoIP web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices...

CVE-2025-3927 CVE-2025-3927

Digigram's PYKO-OUT audio-over-IP AoIP web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices...

CVE-2025-3927

CVE-2025-3927 concerns Digigram PYKO-OUT AoIP, where the web-server defaults to no password. This allows any attacker on the target network (e.g., at the device’s 192.168.0.100 address) to connect and take control of the device, potentially pivoting to connected network or hardware components. Th...

BIT-MOODLE-2024-34004 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

PT-2025-18785 · Digigram · Digigram Pyko-Out

Name of the Vulnerable Software and Affected Versions: Digigram PYKO-OUT affected versions not specified Description: The issue concerns the default configuration of the Digigram PYKO-OUT audio-over-IP web-server, which does not require a password. This allows any attacker with the target IP...