Rockwellautomation 1763-l16awa Exposure of Sensitive Information to an Unauthorized Actor

An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00...

CVE-2013-1771

The web server Monkeyd produces a world-readable log /var/log/monkeyd/master.log on gentoo...

Code injection

The web server Monkeyd produces a world-readable log /var/log/monkeyd/master.log on gentoo...

CVE-2013-1771

The web server Monkeyd produces a world-readable log /var/log/monkeyd/master.log on gentoo...

CVE-2013-1771

CVE-2013-1771 affects the Monkeyd web server, where the master.log (/var/log/monkeyd/master.log) is world-readable on Gentoo due to permissions. This could expose log contents (e.g., requests) as described in the provided sources. No concrete exploit details or patch/version remediation are prese...

CVE-2013-1771

The web server Monkeyd produces a world-readable log /var/log/monkeyd/master.log on gentoo...

CVE-2009-5046

JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22...

Metasploit Pro 4.16 and earlier install the web server SSL server.key as local-user readable by default

Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to...

httpd: mod_auth_digest: access control bypass due to race condition

A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions...

rConfig Detection

Detection of rConfig. The script sends a connection request to the server and attempts to detect rConfig. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Cross-Site Scripting (XSS)

apache-airflow is vulnerable to cross-site scripting XSS. An administrative user is able to edit the state of objects in the metadata database to contain malicious Javascript, which will execute in a victim's browser when rendered. This vulnerability also allows reading of arbirary files permitte...

PYSEC-2019-216

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...

Schneider Electric Modicon M580/M340/BMxCRA/140CRA Denial of Service Vulnerability (CNVD-2019-41497)

The Modicon M580/M340/BMxCRA/140CRA are programmable logic controllers from Schneider Electric. A denial of service vulnerability exists in the Schneider Electric Modicon M580/M340/BMxCRA/140CRA. An attacker can exploit this vulnerability to cause a denial of service by upgrading the controller v...

Schneider Electric Modicon M580/M340/BMxCRA/140CRA Denial of Service Vulnerability (CNVD-2019-41495)

The Modicon M580/M340/BMxCRA/140CRA are programmable logic controllers from Schneider Electric. A denial of service vulnerability exists in the Schneider Electric Modicon M580/M340/BMxCRA/140CRA. An attacker can exploit this vulnerability to cause a denial of service by upgrading the controllers...

CVE-2019-6844

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules all firmware versions, which could cause a Denial of Service atack on the PLC when upgrading the controller with a firmware package containing an invalid we...

IntraSrv Buffer Overflow Vulnerability

IntraSrv is a web server. A buffer overflow vulnerability exists in version 1.0 2007-06-03 of IntraSrv. The vulnerability stems from a networked system or product that performs an operation in memory without properly validating data boundaries, resulting in incorrect read and write operations bei...

Debian DLA-1970-1 : php5 security update

Emil Lerner, beched and d90pwn found a buffer underflow in php5-fpm, a Fast Process Manager for the PHP language, which can lead to remote code execution. Instances are vulnerable depending on the web server configuration, in particular PATHINFO handling. For a full list of preconditions, check:...

Code Execution Vulnerability in MyuCMS v2.1.1022

MyuCMS is a content management system developed using ThinkPHP. A code execution vulnerability exists in MyuCMS v2.1.1022, which can be exploited by an attacker to gain control of a web server...

Command Execution Vulnerability in MyuCMS v2.1.1020

MyuCMS is a content management system developed using ThinkPHP. A command execution vulnerability exists in MyuCMS v2.1.1020, which can be exploited by an attacker to gain control of a web server...

File Upload Vulnerability in PowerCreator CMS

PowerCreator is a software development and product manufacturing company for the global audio and video industry. A file upload vulnerability exists in PowerCreator CMS, which can be exploited by an attacker to gain control of the web server...