v.26.3.2229

Configuration

This page lists 407 vulnerabilities in this category.

Critical: 4 High: 133 Medium: 174 Low: 51 Information: 45

Vulnerability Name

CVE

CWE

Severity

MovableType remote code execution

CVE-2015-1592

CWE-94

High

Apache Spark Master Unauthorized Access Vulnerability

CWE-200

High

Apache REST RCE CVE-2018-11770

CVE-2018-11770

CWE-94

High

Apache Tapestry weak secret key

CWE-693

High

Docker Engine API is accessible without authentication

CWE-287

High

Docker Registry API is accessible without authentication

CWE-287

High

Web Cache Poisoning via Fat GET Request

CWE-44

High

Web Cache Poisoning via Host Header

CWE-44

High

Web Cache Poisoning via JSONP and UTM_ parameter

CWE-44

High

GoCD information disclosure (CVE-2021-43287)

CVE-2021-43287

CWE-200

High

Web Cache Poisoning through HTTP/2 pseudo-headers

CWE-44

High

Laravel Terminal open

CWE-200

High

Oracle E-Business Suite Information Disclosure

CWE-200

High

Request Smuggling

CWE-444

High

RethinkDB administrative interface publicly exposed

CWE-200

High

Web Cache Poisoning via semicolon query separator

CWE-44

High

Apache Airflow Experimental API Auth Bypass CVE-2020-13927

CVE-2020-13927

CWE-200

High

Unrestricted access to Caddy API interface

CWE-200

High

Delve Debugger Unauthorized Access Vulnerability

CWE-200

High

Unrestricted access to Haproxy Data Plane API

CWE-200

High

RoR Database Configuration File Detected

CWE-538

High

JWT Signature Bypass via unvalidated jwk parameter

CWE-287

High

Apache Tomcat version older than 6.0.35

CVE-2012-0022

CWE-264

High

Devise weak password

CWE-200

High

JAAS authentication bypass

CWE-693

High

Multiple vulnerabilities in Ioncube loader-wizard.php

CWE-552

High

The Heartbleed Bug

CVE-2014-0160

CWE-200

High

HTTP verb tampering via POST

CWE-285

High

Method Tampering

CWE-285

High

The DROWN attack (SSLv2 supported)

CVE-2016-0800

CWE-310

High

Apache Tomcat version older than 7.0.28

CVE-2012-4534

CWE-20

High

Core dump file

CWE-200

High

Vulnerable project dependencies

CWE-937

High

Adobe ColdFusion 9 administrative login bypass

CVE-2013-0632

CWE-287

High

CodeIgniter session decoding vulnerability

CWE-327

High

PHP magic_quotes_gpc is disabled

CWE-150

High

Apache Axis2 administration console weak password

CWE-200

High

GlassFish admin console weak credentials

CWE-693

High

Java Debug Wire Protocol remote code execution

CWE-94

High

IBM WebSphere administration console weak password

CWE-200

High

Microsoft IIS WebDAV authentication bypass

CVE-2009-1535

CWE-287

High

Jenkins weak password

CWE-200

High

Microsoft IIS5 NTLM and Basic authentication bypass

CVE-2007-2815

CWE-264

High

SAP weak/predictable user credentials

CWE-200

High

Weak password

CWE-200

High

WebLogic admin console weak credentials

CWE-693

High

Webmail weak password

CWE-200

High

Web application default/weak credentials

CWE-200

High

Apache Roller OGNL injection

CVE-2013-4212

CWE-20

High

Apache Tomcat version older than 6.0.36

CVE-2012-4534

CWE-20

High

Apache Tomcat version older than 7.0.21

CVE-2011-3190

CWE-264

High

Apache Tomcat version older than 7.0.23

CVE-2012-0022

CWE-189

High

JIRA Security Advisory 2013-02-21

CWE-22

High

Apache Tomcat version older than 7.0.30

CVE-2012-3546

CWE-20

High

IIS extended unicode directory traversal vulnerability

CVE-2000-0884

CWE-22

High

WebDAV Directory Has Write Permissions

CWE-264

High

MediaWiki remote code execution

CVE-2014-1610

CWE-20

High

Magento Cacheleak

CWE-200

High

Jetpack 2.9.3: Critical Security Update

CVE-2014-0173

CWE-287

High

Code Execution via WebDav

CWE-434

High

Joomla 1.5 end of life

CWE-1104

High

Joomla! 3.2.1 sql injection

CWE-89

High

ASP.NET forms authentication using inadequate protection

CWE-16

Medium

Node.js Web Application does not handle uncaughtException

CWE-248

Medium

Joomla J!Dump extension enabled

CWE-200

Medium

Unrestricted access to AnythingLLM API

CVE-2024-6842

CWE-200

Medium

Next.js image Blind SSRF

CWE-918

Medium

Lucee Stacktrace Information Disclosure

CWE-200

Medium

ASP.NET event validation disabled

CWE-16

Medium

Express Development Mode enabled

CWE-200

Medium

ASP.NET Deny missing from authorization rule on location

CWE-16

Medium

RoR Development Mode enabled

CWE-200

Medium

ASP.NET potential HTTP Verb Tampering

CWE-16

Medium

Node.js Web Application does not handle unhandledRejection

CWE-248

Medium

Joomla Debug Console enabled

CWE-200

Medium