Search
Total
11 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-0220 | 5 Apache, Canonical, Debian and 2 more | 5 Http Server, Ubuntu Linux, Debian Linux and 2 more | 2022-07-25 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them. | |||||
| CVE-2022-30621 | 1 Cellinx | 2 Cellinx Nvt - Ip Ptz Camera, Cellinx Nvt - Ip Ptz Camera Firmware | 2022-07-22 | N/A | 6.5 MEDIUM |
| Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user. | |||||
| CVE-2021-31920 | 1 Istio | 1 Istio | 2022-07-12 | 4.0 MEDIUM | 6.5 MEDIUM |
| Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used. | |||||
| CVE-2022-29448 | 1 Wow-estore | 1 Herd Effects | 2022-05-26 | 4.0 MEDIUM | 4.9 MEDIUM |
| Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. | |||||
| CVE-2019-19493 | 1 Kentico | 1 Kentico | 2022-02-20 | 3.5 LOW | 5.4 MEDIUM |
| Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS. | |||||
| CVE-2021-32054 | 1 Fire.ly | 1 Spark | 2021-05-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered to clients such that they are rendered directly in a victim's web browser. | |||||
| CVE-2020-4719 | 1 Ibm | 1 Cloud Application Performance Management | 2021-03-09 | 4.0 MEDIUM | 4.9 MEDIUM |
| The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861. | |||||
| CVE-2020-35566 | 1 Mbconnectline | 2 Mbconnect24, Mymbconnect24 | 2021-02-19 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An attacker can read arbitrary JSON files via Local File Inclusion. | |||||
| CVE-2018-0237 | 1 Cisco | 1 Advanced Malware Protection For Endpoints | 2020-09-04 | 5.0 MEDIUM | 5.8 MEDIUM |
| A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could allow an unauthenticated, remote attacker to bypass malware detection. The vulnerability occurs because the software relies on only the file extension for detecting DMG files. An attacker could exploit this vulnerability by sending a DMG file with a nonstandard extension to a device that is running an affected AMP for Endpoints macOS Connector. An exploit could allow the attacker to bypass configured malware detection. Cisco Bug IDs: CSCve34034. | |||||
| CVE-2019-0816 | 2 Canonical, Microsoft | 2 Ubuntu Linux, Azure | 2020-08-24 | 1.9 LOW | 5.1 MEDIUM |
| A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'. | |||||
| CVE-2018-6112 | 3 Debian, Google, Redhat | 5 Debian Linux, Chrome, Enterprise Linux Desktop and 2 more | 2019-10-03 | 4.3 MEDIUM | 4.3 MEDIUM |
| Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | |||||