60.304 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Search: http
2791 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-4329 | MED 6.5 | cisco telepresence_video_communication_server_software The administrator web interface in Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796. | 2.3% | — |
| CVE-2021-1287 | HIGH 7.2 | cisco rv132w_firmware A vulnerability in the web-based management interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device | 2.3% | — |
| CVE-2018-8016 | CRIT 9.8 | apache cassandra The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. | 2.3% | — |
| CVE-2020-17517 | HIGH 7.5 | apache ozone The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthori | 2.3% | — |
| CVE-2011-0348 | MED 6.4 | cisco ios Cisco IOS 12.4(11)MD, 12.4(15)MD, 12.4(22)MD, 12.4(24)MD before 12.4(24)MD3, 12.4(22)MDA before 12.4(22)MDA5, and 12.4(24)MDA before 12.4(24)MDA3 on the Cisco Content Services Gateway Second Generation (aka CSG2) allows remote attackers to bypass intended acce | 2.3% | — |
| CVE-2010-1406 | MED 4.3 | apple safari WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP ser | 2.3% | — |
| CVE-2018-0260 | MED 5.3 | cisco mate_live A vulnerability in the web interface of Cisco MATE Live could allow an unauthenticated, remote attacker to view and download the contents of certain web application virtual directories. The vulnerability is due to lack of proper input validation and authorizat | 2.3% | — |
| CVE-2018-0440 | HIGH 7.2 | cisco data_center_network_manager A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input val | 2.3% | — |
| CVE-2025-23317 | CRIT 9.1 | nvidia triton_inference_server NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a specially crafted HTTP request. A successful exploit of this vulnerability might lead to remote code execution, denial of ser | 2.3% | — |
| CVE-2020-5868 | CRIT 9.8 | f5 big-iq_centralized_management In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface. | 2.2% | — |
| CVE-2019-1631 | MED 5.3 | cisco integrated_management_controller A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data pr | 2.2% | — |
| CVE-2017-12354 | MED 5.3 | cisco secure_access_control_system A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not sufficie | 2.2% | — |
| CVE-2016-1352 | CRIT 9.8 | cisco unified_computing_system_central_software Cisco Unified Computing System (UCS) Central Software 1.3(1b) and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuv33856. | 2.2% | — |
| CVE-2005-3059 | HIGH 10.0 | opera opera_browser Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding." | 2.2% | — |
| CVE-2016-1359 | HIGH 8.8 | cisco prime_infrastructure Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a log file, aka Bug ID CSCuw81494. | 2.2% | — |
| CVE-2024-21643 | HIGH 7.1 | microsoft identitymodel_extensions IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Mi | 2.2% | — |
| CVE-2019-1843 | HIGH 8.6 | cisco rv110w_firmware A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to cause a reload of an | 2.2% | — |
| CVE-2020-1654 | CRIT 9.8 | juniper junos On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, processing a malformed HTTP message can lead to a Denial of Service (DoS) or Remote Code Execution (RCE) Continued processing of this malformed HTTP messa | 2.2% | — |
| CVE-2025-27473 | HIGH 7.5 | microsoft windows_10_1507 Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. | 2.2% | — |
| CVE-2018-15505 | HIGH 7.5 | embedthis appweb An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trail | 2.2% | — |
| CVE-2023-30846 | CRIT 9.1 | microsoft typed-rest-client typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as fol | 2.2% | — |
| CVE-2020-3411 | HIGH 7.5 | cisco catalyst_center A vulnerability in Cisco DNA Center software could allow an unauthenticated remote attacker access to sensitive information on an affected system. The vulnerability is due to improper handling of authentication tokens by the affected software. An attacker coul | 2.2% | — |
| CVE-2015-6310 | MED 5.0 | cisco unified_communications_manager_im_and_presence_service The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a crafted HTTP request, aka Bug ID CSCuw31632. | 2.2% | — |
| CVE-2015-6288 | MED 5.0 | cisco content_security_management_appliance Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials, which allows remote attackers to cause a denial of service (rapid log-file rollover and application fault) via crafted HTTP requests, aka Bug ID CSCuw09620. | 2.2% | — |
| CVE-2020-3315 | MED 5.3 | cisco ios Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors in how the Snort detecti | 2.2% | — |