19918 matches found
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
CVE-2020-15790
A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. If configured in an insecure manner, the web server might be susceptible to a directory listing attack...
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
Design/Logic Flaw
A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. If configured in an insecure manner, the web server might be susceptible to a directory listing attack...
Design/Logic Flaw
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
Command injection
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
CVE-2020-15790
A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. If configured in an insecure manner, the web server might be susceptible to a directory listing attack...
CVE-2020-15790
CVE-2020-15790 affects Siemens Spectrum Power 4 (all versions before v4.70 SP8) and is tied to Expos ure of Information Through Directory Listing when the web server is misconfigured. The connected advisory (ICS-CISA ICSA-20-252-04 and related Siemens/Red Hat/NVD records) confirms a directory-lis...
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...
CVE-2020-24916
CVE-2020-24916 affects the Yaws web server CGI implementation, with versions 1.81–2.0.7 vulnerable. The root cause is that CGI requests are not properly sanitized, enabling a remote attacker to execute arbitrary shell commands by crafting CGI executable names. This is a remote, unauthenticated co...
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...
CVE-2020-24379
CVE-2020-24379 affects Yaws, a Erlang-based HTTP server. The WebDAV implementation in Yaws versions 1.81–2.0.7 is vulnerable to a XML External Entity (XXE) injection in input handling. Exploitation could lead to sensitive data exposure via XXE. Public fixes exist: Debian/Ubuntu advisories update ...
Joomla! 2.5.x < 3.9.21 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.21. It is, therefore, affected by multiple vulnerabilities. - Lack of escaping in modlatestactions allows Cross-Site Scripting XSS attacks. CVE-2020-24599 - Lack of input...
Debian DSA-4762-1 : lemonldap-ng - security update
It was discovered that the default configuration files for running the Lemonldap::NG Web SSO system on the Nginx web server were susceptible to authorisation bypass of URL access rules. The Debian packages do not use Nginx by default. C Tenable Network Security, Inc. The descriptive text and...
Yaws 2.0.7 XML Injection / Command Injection
Exploit Title: Multiple vulnerabilities in Yaws web server Date: 2020-08-10 Exploit Author: Alexey Pronin （vulnbe） Vendor Homepage: http://yaws.hyber.org/ Software Link: https://github.com/erlyaws/yaws Versions affected: 1.81 - 2.0.7 CVE: CVE-2020-24379, CVE-2020-24916 1. Description:...
Command Execution Vulnerability in Extreme CMS of Langfang Extreme Network Technology Co.
Extreme CMS is an open source content management system. Ltd. Extreme CMS has a command execution vulnerability that can be exploited by an attacker to gain access to the web server...
