19904 matches found
Zyxel Nbg6816和Zyxel Nbg6817 跨站请求伪造漏洞
The Zyxel Nbg6816 and Zyxel Nbg6817 are both products of China's Hopkins Technology Zyxel.The Zyxel Nbg6816 is a dual-band wireless gigabit router.The Zyxel Nbg6817 is a wireless router. The Zyxel Nbg6816 and Zyxel Nbg6817 suffer from a cross-site request forgery vulnerability that stems from...
Mongoose Web Server < 7.6 File Upload Vulnerability
Mongoose Web Server is prone to an arbitrary file upload vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
VulnCheck KEV: CVE-2017-7659
A maliciously constructed HTTP/2 request could cause modhttp2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process...
VulnCheck KEV: CVE-2017-7668
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows apfindtoken to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or...
(Pwn2Own) Cisco RV340 NGINX Missing Authentication Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the NGINX web server. The issue results from...
(Pwn2Own) Cisco RV340 NGINX Improper Authentication Unrestricted File Upload Vulnerability
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Cisco RV340 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
ruby: Potential HTTP request smuggling in WEBrick
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...
WPCargo < 6.9.0 - Unauthenticated RCE
The plugin contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE PoC import sys import binascii import requests This is a magic string that when treated as pixels and compressed using the png algorithm, will cause to be written ...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25323
ZEROF Web Server 2.0 allows /admin.back XSS...
CVE-2022-25323
ZEROF Web Server 2.0 allows /admin.back XSS...
CVE-2022-25323
ZEROF Web Server 2.0 allows /admin.back XSS...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
Cross site scripting
ZEROF Web Server 2.0 allows /admin.back XSS...
Sql injection
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
EUVD-2022-30005
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25322
CVE-2022-25322 affects ZEROF Web Server 2.0, where the endpoint /HandleEvent is vulnerable to SQL Injection . The NVD/NVD-derived metrics list CVSS v3.1 base score 9.8 (CRITICAL) and CVSS v2 base 7.5 (HIGH);攻击面 is NETWORK with low complexity and no authentication. Connected sources describe explo...