CVE-2012-5626

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation...

CVE-2012-5626

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation...

Razer: SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter

The tester discovered a SQL injection issue that allowed access to data via Razer Gold Thailand's sea-web server. Razer appreciates the clear and thorough report...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2019-1631)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Easy XML Editor 1.7.8 - XML External Entity Injection

Exploit Title: Easy XML Editor 1.7.8 - XML External Entity Injection Exploit Author: Javier Olmedo Date: 2018-11-21 Vendor: Richard Wuerflein Software Link: https://www.edit-xml.com/EasyXMLEditor.exe Affected Version: 1.7.8 and before Patched Version: unpatched Category: Local Platform: XML Teste...

Red Hat Undertow Resource Management Error Vulnerability

Red Hat Undertow is a U.S. Red Hat Red Hat, a Java-based embedded Web server, is the default Web server Wildfly Java application server. A resource management error vulnerability exists in Red Hat Undertow, which can be exploited by an attacker to cause a denial of service...

CVE-2020-7222

An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter to true in this JavaScript code can bypass authentication and achieve limited privileges...

CVE-2020-7222

An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter to true in this JavaScript code can bypass authentication and achieve limited privileges...

Authentication flaw

An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter to true in this JavaScript code can bypass authentication and achieve limited privileges...

CVE-2020-7222

CVE-2020-7222 : Amcrest Web Server 2.520.AC00.18.R (2017-06-29 WEB 3.2.1.453504) contains a login bypass flaw. The login page returns JavaScript; if an attacker alters the result parameter to true in that script, authentication is bypassed and the attacker gains limited privileges (can view all o...

CVE-2020-7222

An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter to true in this JavaScript code can bypass authentication and achieve limited privileges...

[SECURITY] Fedora 31 Update: jetty-9.4.24-2.v20191120.fc31

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

Unspecified Vulnerability in Oracle HTTP Server (CNVD-2020-09678)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection and other functions. HTTP Server is one of the HTTP server component. An unspecified vulnerability...

Ubiquiti Inc.: Web Server Predictable Session ID on EdgeSwitch

In EdgeSwitch legacy web interface the SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection. These vulnerabilities were found on EdgeSwitch 1G switch ESWH and EdgeSwitch 10G switch ESGH firmware v1.9.0. The fix for the...

Content Delivery Networks handle HTTP headers in different and unexpected ways

Overview A Content Delivery Network CDN is a distributed network of proxy servers that deliver web content collected from a back end web server using a temporary local storage called a cache. HTTP cache poisoning is a type of attack that allows a remote attacker to inject arbitrary content using...

CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

NGINX Information Disclosure Vulnerability

NGINX is a lightweight Web server/reverse proxy server and e-mail IMAP/POP3 proxy server from the U.S. company NGINX. The NGINX information disclosure vulnerability can be exploited by an attacker to allow nginx to expose sensitive information over the network...

Cisco Emergency Responder Stored Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of some parameters that are passed...

DTEN D5 and DTEN D7 Information Disclosure Vulnerabilities

The DTEN D5 and DTEN D7 are both stylus pens from DTEN. A security vulnerability exists in DTEN D5 and D7 versions prior to version 1.3.2, which originates from a lack of authentication of the web server on TCP port 8080. The vulnerability can be exploited by an attacker to read stored whiteboard...

Pete Stein GoScript Remote Command Execution Vulnerability

Pete Stein GoScript is a web file processing script developed by software developer Pete Stein. A remote command execution vulnerability exists in go.cgi in Pete Stein GoScript version 2.0. A remote attacker could use this vulnerability to perform unauthorized operations on an affected computer i...