2608 matches found
Medium: http-parser
Issue Overview: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers almost 80 KB per connection, and carefully timed completion of the headers, it is possible to...
CVE-2018-7159
It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior...
CVE-2019-17502
Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...
Null pointer dereference
Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...
CVE-2019-17502
CVE-2019-17502 affects Hydra up to version 0.1.8 and involves a NULL pointer dereference that can crash the daemon when processing POST requests without a Content-Length header. The issue is tied to read.c, request.c, and util.c, with the process_header_end() function calling boa_atoi(), which ul...
CVE-2019-17502
Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...
CVE-2009-0840
Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header...
F5 Networks BIG-IP : Node.js vulnerability (K27228191)
The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been...
The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to execute arbitrary code or cause a service failure.
The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 lies in a buffer overflow issue during the processing of input data using the Content-Length header. Exploiting this vulnerability allows an attacker to...
Scientific Linux Security Update : http-parser on SL7.x x86_64 (20190806)
Security Fixes : - nodejs: Denial of Service with large HTTP headers CVE-2018-12121 - nodejs: HTTP parser allowed for spaces inside Content-Length header values CVE-2018-7159 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description...
CVE-2014-10375
handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...
Design/Logic Flaw
handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...
UBUNTU-CVE-2014-10375
handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...
CVE-2014-10375
handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...
CVE-2014-10375
handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...
CVE-2014-10375
Removed by vendor...
CVE-2014-10375
CVE-2014-10375 concerns eXosip’s handling of TLS messages in the eXtl_tls.c module (pre-5.0.0) where a negative value in a Content-Length header is mishandled. The vulnerability originates from the content-length parsing logic in handle_messages, enabling malformed TLS headers to affect eXosip pr...
Moderate: Red Hat Security Advisory: http-parser security update
An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
nodejs: HTTP parser allowed for spaces inside Content-Length header values
It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior...
GrandNode 4.40 Path Traversal / File Download
Exploit Title: GrandNode Path Traversal & Arbitrary File Download Unauthenticated Date: 06/23/3019 Exploit Author: Corey Robinson https://twitter.com/CRobSec Vendor Homepage: https://grandnode.com/ Software Link:...