CVE-2017-2666

This repository does not have a README...

EUVD-2021-0851

Malware in sbrugna...

GHSA-QJWC-V72V-FQ6R HTTP request smuggling in Undertow

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

HTTP request smuggling in Undertow

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

HTTP Request Smuggling in Undertow

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

GHSA-P9W3-GWC2-CR49 HTTP Request Smuggling in Undertow

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests

A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...

CVE-2017-2666

creationtimestamp| type| source ---|---|--- 2021-02-23 20:35:21+00:00| seen| https://t.me/cibsecurity/24005...

Design/Logic Flaw

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

CVE-2021-20220

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

Design/Logic Flaw

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests

A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...

HTTP Request Smuggling

wildfly-undertow is vulnerable to HTTP request smuggling. The vulnerability exists against HTTP/1.x and HTTP/2 due to an incomplete fix for CVE-2017-2666, permitting invalid characters in an HTTP request. An attacker is able to poison a web-cache, perform an XSS attack, or obtain sensitive...

Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests

A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...

CVE-2017-7559

It was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the...

br.eti.clairton:ds-test (0.4.0), br.jus.stf.digital:core (>=2.0.0, <=2.3.1) +413 more potentially affected by CVE-2017-2666 via io.undertow:undertow-core (>=1.4.0.final, <=1.4.16.final)

io.undertow:undertow-core MAVEN version =1.4.0.final, =2.0.0, =0.0.4, =0.2.7, =1.2.0, =1.5.0, =1, =1, =1.0, =5.7.0.undertow2, =0.9.0, =0.9.0, =0.9.0, =1.0.1 and more Source cves: CVE-2017-2666 Source advisory: GHSA-MCFM-H73V-635M...

ch.digitalfondue.stampo:ch.digitalfondue.stampo.gradle.plugin (0.0.3), ch.digitalfondue.stampo:stampo (>=1.0, <=1.2.1) +848 more potentially affected by CVE-2017-2666 via io.undertow:undertow-core (>=1.0.0.alpha1, <=1.3.30.final)

io.undertow:undertow-core MAVEN version =1.0.0.alpha1, =1.0, =1.0, =0.1.0, =0.2.0, =1.1.11, =1.1.11, =1.1.16, =1.0.1, =1.1.0, =0.0.8, =0.0.8, =0.1.0, =0.0.6, =0.1.3 and more Source cves: CVE-2017-2666 Source advisory: GHSA-MCFM-H73V-635M...

ch.digitalfondue.stampo:ch.digitalfondue.stampo.gradle.plugin (0.0.3), ch.digitalfondue.stampo:stampo (>=1.0, <=1.2.1) +848 more potentially affected by CVE-2017-2666 via io.undertow:undertow-core (>=1.0.0.alpha1, <=1.3.30.final)

io.undertow:undertow-core MAVEN version =1.0.0.alpha1, =1.0, =1.0, =0.1.0, =0.2.0, =1.1.11, =1.1.11, =1.1.16, =1.0.1, =1.1.0, =0.0.8, =0.0.8, =0.1.0, =0.0.6, =0.1.3 and more Source cves: CVE-2017-2666 Source advisory: OSV:GHSA-MCFM-H73V-635M...

br.eti.clairton:ds-test (0.4.0), br.jus.stf.digital:core (>=2.0.0, <=2.3.1) +413 more potentially affected by CVE-2017-2666 via io.undertow:undertow-core (>=1.4.0.final, <=1.4.16.final)

io.undertow:undertow-core MAVEN version =1.4.0.final, =2.0.0, =0.0.4, =0.2.7, =1.2.0, =1.5.0, =1, =1, =1.0, =5.7.0.undertow2, =0.9.0, =0.9.0, =0.9.0, =1.0.1 and more Source cves: CVE-2017-2666 Source advisory: OSV:GHSA-MCFM-H73V-635M...

RHEL 6 : JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 6 (Moderate) (RHSA-2017:1410)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1410 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red...