CVE-2025-27415 Nuxt allows DOS via cache poisoning with payload rendering response

Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as...

Nuxt security vulnerabilities

Nuxt is a free open source framework from Nuxt Open Source. A security vulnerability exists in Nuxt versions prior to 3.16.0 that originates from a specially crafted HTTP request sent to a server behind a CDN, which may poison the CDN cache in some cases, severely impacting site availability...

PT-2025-11961

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 3.16.0 Description Nuxt is an open-source web development framework for Vue.js. By sending a crafted HTTP request to a server behind a CDN, it is possible to poison the CDN cache, severely impacting the availability of a...

CVE-2025-27415: Acceptance of Extraneous Untrusted Data With Trusted Data

Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as...

OData Protocol Cache Poisoning Session Interception

The vulnerability of the OData protocol implementation in SAP Fiori for SAP ERP business application development platforms is related to deficiencies in handling HTTP header requests. Exploiting this vulnerability allows a malicious actor to perform a cache poisoning attack or intercept sessions ...

Security Bulletin: IBM DataStage on Cloud Pak for Data is vulnerable to authentication and command execution issues due to the Eclipse Jetty package (CVE-2023-36479, CVE-2023-40167, CVE-2023-41900)

Summary Eclipse Jetty is used by IBM DataStage on Cloud Pak for Data as part of web server functionality. Vulnerability Details CVEID:CVE-2023-36479 DESCRIPTION: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific...

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

CVE-2023-35894

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2023-35894

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2023-35894

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2023-35894

IBM Control Center (IBM Sterling Control Center) versions 6.2.1 and 6.3.1 are affected by CVE-2023-35894 due to improper validation of HOST header input, enabling HTTP header injection that can lead to cross-site scripting, cache poisoning, or session hijacking. Remediation per IBM bulletin: upgr...

CVE-2023-35894 IBM Control Center HOST header injection

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

Security Bulletin: IBM Sterling Control Center is vulnerable to HTTP Host Header Injection Vulnerability

Summary HTTP Host Header Injection Vulnerability is affecting Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2023-35894 DESCRIPTION: IBM Sterling Control Center is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow ...

PT-2025-10117

Name of the Vulnerable Software and Affected Versions IBM Control Center versions 6.2.1 through 6.3.1 Description The issue is caused by improper validation of input by the HOST headers, leading to HTTP header injection. This could allow an attacker to conduct various attacks against the vulnerab...

CVE-2023-35894: Improper Neutralization of HTTP Headers for Scripting Syntax

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

Linux Distros Unpatched Vulnerability : CVE-2024-24557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image ...

Linux Distros Unpatched Vulnerability : CVE-2024-21510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When makin...

Linux Distros Unpatched Vulnerability : CVE-2021-23336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to We...

Linux Distros Unpatched Vulnerability : CVE-2016-10152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The readconfigfile function in lib/hesiod.c in Hesiod 3.2.1 falls back to the .athena.mit.edu default domain when opening the configuration file fails, which...

Linux Distros Unpatched Vulnerability : CVE-2016-4554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mimeheader.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a...