241 matches found
CVE-2026-92390
A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 Early Hints response or through specific header ordering. This flaw allows...
curl: curl: -J no-clobber guarantee bypassed with 103 early hints
A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 Early Hints response or through specific header ordering. This flaw allows...
CURL-CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
-J no-clobber guarantee bypassed with 103 early hints
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
PT-2026-114424
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
Astra Linux – Vulnerability in Firefox
When using the Performance API, attackers were able to detect subtle differences between PerformanceEntries, thereby determining whether the target URL had undergone a redirect. This vulnerability affects Firefox 103...
Astra Linux – Vulnerability in Chromium
Before version 103.0.5060.53, using free after in the WebApp Provider in Google Chrome allowed a remote attacker who convinced the user to engage in certain user interactions to potentially exploit heap corruption through specific UI interactions...
Astra Linux – Vulnerability in Chromium
Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 103.0.5060.53, using "use after free" in Interest groups in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Firefox
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs in Firefox 102. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefo...
curl: CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints
Hi all, I found a way for a server to defeat --remote-header-name's -J no-clobber guarantee: with curl -O -J -i, sending a 103 Early Hints before the final response or an ETag ahead of Content-Disposition under --etag-save lets a server overwrite an existing file it names via Content-Disposition,...
CVE-2026-42584 Netty: HttpClientCodec response desynchronization
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103,...
Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2ECS-2026-103 (ALASECS-2026-103)
The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-103 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...
CVE-2023-54328 AimOne Video Converter 2.04 Build 103 Buffer Overflow in Registration Form
AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate a 7000-byte payload to trigger the denial of service and potentially exploit the software's registration mechanism...
CVE-2023-54328
AimOne Video Converter 2.04 Build 103 is affected by a buffer overflow in the registration form that can crash the application and enable denial of service via a ~7000-byte payload. Affected component: registration form handling; impact described as crash/DoS with potential abuse of the registrat...
CVE-2023-54328 AimOne Video Converter 2.04 Build 103 Buffer Overflow in Registration Form
AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate a 7000-byte payload to trigger the denial of service and potentially exploit the software's registration mechanism...
AimOne Video Converter 安全漏洞
AimOne Video Converter is a video format conversion tool from AimOne. A security vulnerability exists in AimOne Video Converter version 2.04 Build 103, which originates from a buffer overflow in the registry form that could lead to an application crash and denial of service attack...
CVE-2019-16731
The udpServerSys service in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to initiate firmware upgrades and alter device settings...
