File upload vulnerability exists in uublog (CNVD-2020-33969)

uublog is a lightweight PHP blog system source code developed in PHP + MySQL. uublog has a file upload vulnerability that can be exploited by an attacker to gain control of the web server...

undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS

A vulnerability was found in the Undertow HTTP server listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service DOS to make the service unavailable on SSL...

CVE-2020-13227

CVE-2020-13227 concerns Sysax Multi Server 6.90. The vulnerability arises in the web server component where triggering an invalid path permission error bypasses the fakepath protection, allowing an attacker to determine the username under which the server is running. Affected product: Sysax Multi...

Reel Environmental Issues Vulnerability

Reel is an open source "event-based" Web server . An environmental issue vulnerability exists in Reel 0.6.1 and earlier versions, which can be exploited to conduct HTTP request smuggling attacks because the program does not properly parse the Content-Length and Transfer Encoding headers...

HTTP Request Smuggling

Overview reel is a fast, non-blocking "evented" web server built on httpparser.rb, websocket-driver, Celluloid::IO, and nio4r. Note: This project is deprecated, and is not maintained anymore. Affected versions of this package are vulnerable to HTTP Request Smuggling. HTTP pipelining issues and...

The vulnerability of Siemens SCALANCE S network gateways’ microprogramming software is related to uncontrolled resource consumption (exhaustion), which allows attackers to trigger a service failure of the web server.

The vulnerability of Siemens SCALANCE S network gateways’ microprogramming software is related to uncontrolled resource consumption exhaustion. Exploiting this vulnerability can allow a malicious actor to trigger a service failure of the web server using specially created packets sent to port...

File upload vulnerability in emlog

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. A file upload vulnerability exists in emlog, which can be exploited by attackers to gain control of a web server...

The vulnerability of the microprogramming software of the programmable logic controller SIMATIC S7-1200 allows a intruder to execute malicious JavaScript code.

The vulnerability of the microprogrammed control system for the SIMATIC S7-1200 programmable logic controller is related to the lack of security measures taken for the web server. Exploiting this vulnerability allows a malicious actor to execute malicious JavaScript code remotely...

The vulnerability of the configuration for connecting microprogramming software-based Cisco IP phones to web servers allows a perpetrator to execute arbitrary code or cause a service failure.

The vulnerability of the configuration for connecting microprogrammed IP telephones to web servers is related to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a service failure by using a specially created HTTP...

File Upload Vulnerability in Aiwo Real Estate System

Love nest real estate system is based on the second development of the intimate cat v4.7, specifically for the real estate industry customized set of systems. There is a file upload vulnerability in AiWo Real Estate System, which can be exploited by attackers to gain control of the web server...

Command Execution Vulnerability in CFCA Front Office Back Office Management System

CICC Financial Certification Center Limited is a national authoritative security certification body. A command execution vulnerability exists in the backend management system of CFCA's front-end, which can be exploited by an attacker to gain control of a web server...

Code Execution Vulnerability in Monstra

Monstra is a lightweight content management system CMS. A code execution vulnerability exists in Monstra, which can be exploited by an attacker to gain control of a web server...

MCMS suffers from a file upload vulnerability (CNVD-2020-38496)

MCMS is a website building system of MINGFEI TECHNOLOGY CO. MCMS suffers from a file upload vulnerability that can be exploited by an attacker to gain control of a web server...

Oracle iPlanet External Image Injection (CVE-2020-9314)

An External Image Injection vulnerability exists in Oracle iPlanet Web Server. Successful exploitation of this vulnerability can be used to inject an external image into a site to facilitate phishing...

Siemens En100 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

Siemens S7-1200 Uncontrolled Resource Consumption

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants All versions V4.1, SIMATIC S7-300 PN/DP CPU family incl. related ET200 CPUs and SIPLUS variants All versions V3.X.17, SIMATIC S7-400 PN/DP V6 and below CPU family incl. SIPLUS variants All versions, SIMATIC...

httpd: mod_rewrite configurations vulnerable to open redirect

A flaw was found in Apache HTTP Server httpd versions 2.4.0 to 2.4.41. Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirected instead to an unexpected URL within the request URL...

Buffer overflow vulnerability in multiple Tenda products (CNVD-2020-31409)

The Tenda AC9, among others, is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in httpd in several Tenda products. The vulnerability can be exploited to execute arbitrary code by sending the 'list' parameter to the /goform/SetNetControlList URL...

Puma Environment Error Vulnerability

Puma is a Web server for highly concurrent applications from Evan Phoenix Software Developers in the United States. Puma suffers from an environment error vulnerability. An attacker can exploit this vulnerability to conduct HTTP smuggling attacks...

Puma Environment Error Vulnerability (CNVD-2020-31666)

Puma is a web server for highly concurrent applications. Puma suffers from an environment error vulnerability. An attacker can exploit this vulnerability to conduct HTTP smuggling attacks with an invalid transfer-encoding header...