golang: net/http: limit growth of header canonicalization cache

There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader function. An attacker who submits specially crafted requests to applications linked with net/http's http2 functionality could cause excessive resource consumption that could lead to a denial of...

The vulnerability of the open implementation of the OpenLDAP protocol, related to access to resources using incompatible types, allows a perpetrator to perform a denial-of-service attack.

The vulnerability of the open implementation of the OpenLDAP protocol lies in the access to resources using incompatible types. Exploiting this vulnerability allows a malicious actor to perform a denial-of-service attack by sending a specially crafted request to slapd...

The vulnerability of the OpenLDAP protocol, related to the reallocation of memory, allows a hacker to perform a denial-of-service attack.

The vulnerability of the OpenLDAP protocol lies in the repeated memory release that occurs during the processing of control elements involving value return filters. Exploiting this vulnerability allows a malicious actor to perform a denial-of-service attack by sending a specially crafted request ...

The vulnerability of the Asterisk computer telephone application, related to insufficient validation of input data, allows a perpetrator to perform a service denial.

The vulnerability of the Asterisk computer telephone application is related to insufficient verification of entered data. Exploiting this vulnerability could allow a malicious actor to perform a service denial by sending a specially crafted request...

The vulnerability of the open implementation of the OpenLDAP protocol, related to resource management errors, allows a hacker to perform a denial-of-service attack.

The vulnerability of the open implementation of the OpenLDAP protocol is related to a resource management error. Exploiting this vulnerability allows a malicious actor to perform a denial-of-service attack by sending a specially crafted request to slapd...

The vulnerability of the OpenLDAP protocol lies in its numerical significance loss, which allows a perpetrator to perform a denial-of-service attack.

The vulnerability of the OpenLDAP protocol lies in a countable loss of significance. Exploiting this vulnerability allows a malicious actor to perform a denial-of-service attack by sending a specially crafted request...

CVE-2021-21876

Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

CVE-2021-21877

Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

DEBIAN-CVE-2021-44790

A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier...

The vulnerability of the WS-Addressing plugin in the gSOAP web service development environment allows a attacker to cause a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP web service development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a attacker to trigger a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a attacker to trigger a service failure.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to errors in pointer manipulation during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment allows a perpetrator to execute arbitrary code.

The vulnerability of the WS-Addressing plugin in the gSOAP software development environment is related to integer overflow during SOAP request processing. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted HTTP requests...

Stack overflow

Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests...

Fortinet FortiWeb 缓冲区错误漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A buffer overflow vulnerability exists, whi...

The vulnerability of the Invoker Servlet component in SAP NetWeaver Java Application Server allows a perpetrator to execute arbitrary code or gain full control over the system.

The vulnerability of the Invoker Servlet component in SAP NetWeaver Java Application Server is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain full control over the system through specially crafted HTTP or...

The vulnerability of the serviceattrreq and processrequest functions (sdpd-request.c) in the Bluetooth protocol stack for the Linux BlueZ operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the serviceattrreq and processrequest functions sdpd-request.c in the Bluetooth protocol stack for the Linux BlueZ operating system arises from writing beyond buffer boundaries. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality,...

CVE-2021-43063

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage...

CVE-2021-43063

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage...

Cross site scripting

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage...