The vulnerability of the “Basic HTTP Authentication” method implemented in NPort IAW5000A-I/O Series web servers allows attackers to disclose sensitive information.

The vulnerability of the “Basic HTTP Authentication” method implemented in NPort IAW5000A-I/O Series web servers is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Researcher Demonstrates 4 New Variants of HTTP Request Smuggling Attack

A new research has identified four new variants of HTTP request smuggling attacks that work against various commercial off-the-shelf web servers and HTTP proxy servers. Amit Klein, VP of Security Research at SafeBreach who presented the findings today at the Black Hat security conference, said th...

Researcher Demonstrates 4 New Variants of HTTP Request Smuggling Attack

A new research has identified four new variants of HTTP request smuggling attacks that work against various commercial off-the-shelf web servers and HTTP proxy servers. Amit Klein, VP of Security Research at SafeBreach who presented the findings today at the Black Hat security conference, said th...

Embedthis GoAhead < 4.1.4, 5.x < 5.1.2 Replay Attack Vulnerability

Embedthis GoAhead is prone to a replay attack vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:embedthis:goahead";...

Debian: Security Advisory (DLA-2196-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2196-1] pound security update

Package : pound Version : 2.6-6+deb8u2 CVE ID : CVE-2016-10711 An issue has been found in pound, A request smuggling vulnerability was discovered in pound, a everse proxy, load balancer and HTTPS front-end for Web servers, that may allow attackers to send a specially crafted http request to a web...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

NSA, ASD Release Guidance for Mitigating Web Shell Malware

The U.S. National Security Agency NSA and the Australian Signals Directorate ASD have jointly released a Cybersecurity Information Sheet CSI on mitigating web shell malware. Malicious cyber actors are increasingly deploying web shell malware on victim web servers to execute arbitrary system...

Input Validation Error Vulnerability in Multiple Cisco Products (CNVD-2020-31998)

Cisco IP Phone 7811 and others are an IP phone from Cisco USA. An input validation error vulnerability exists in the web server of multiple Cisco products, which arises from the program failing to properly validate input for HTTP requests. The vulnerability can be exploited to execute code with...

The vulnerability of the Squid proxy server arises from insufficient validation of input data, allowing attackers to gain access to limited HTTP servers.

The vulnerability of the Squid proxy server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to limited HTTP servers through specially crafted HTTP requests...

Information Disclosure

httpd is vulnerable to information disclosure. The vulnerability exists as it was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule...

Apache Traffic Server (ATS) Multiple HTTP Request Smuggling Vulnerabilities

Apache Traffic Server is prone to multiple HTTP request smuggling vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Squid < 7.0.1 XSS Vulnerability (SQUID-2023:6)

Squid is prone to a cross-site scripting XSS vulnerability in cachemgr.cgi. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ACSC Releases Securing Content Management Systems Guide

The Australian Cyber Security Centre ACSC has released a cybersecurity guide outlining strategies for identifying and minimizing risks to web servers from installed content management systems CMS. This guidance provides effective mitigation strategies organizations can use to better protect their...

exploit-database

This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains exploits, shellcodes, and papers for various vulnerabilities in different software and systems. The exploits are categorized by operating system, software, and vulnerability...

Reminder: Safeguard Websites from Cyberattacks

Protect personal and organizational public-facing websites from defacement, data breaches, and other types of cyberattacks by following cybersecurity best practices. The Cybersecurity and Information Security Agency CISA encourages users and administrators to review CISA’s updated Tip on Website...

Fedora Update for varnish FEDORA-2019-a0a0cdef92

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw

If you haven't recently updated your Drupal-based blog or business website to the latest available versions, it's the time. Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three...

Authentication flaw

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...

CVE-2019-17270

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...