GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab DAST analyzer version 2.0 up to and...

This Week in Spring - SpringOne Essentials 2023 edition - January 24th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Today is a very day for you see, today we kick off SpringOne Essentials, the online incarnation of SpringOne, online. Well see you live, on stream, in just a few hours!. SpringOne Essentials is going to be amazing, but before...

This Week in Spring - SpringOne Essentials 2023 edition - January 24th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Today is a very day for you see, today we kick off SpringOne Essentials, the online incarnation of SpringOne, online. We'll see you live, on stream, in just a few hours!. SpringOne Essentials is going to be amazing, but befor...

Design/Logic Flaw

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0...

CVE-2021-39213

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as a workaround...

CVE-2021-39213

GLPI vulnerability CVE-2021-39213 affects GLPI versions 9.1 up to, but not including, 9.5.6, with API Rest enabled. Root cause: API bypass via custom header injection. Impact: potential unauthorized API access and partial confidentiality/integrity/availability impact as per CVSS. Remediation: upd...

kyma-project kyma 输入验证错误漏洞

kyma is an open source platform for scaling applications using microservices and serverless capabilities. kyma-project kyma suffers from an Input Validation Error vulnerability that stems from insufficient input validation in Kyma, where an authenticated user can pass a Header of their choice and...

Limit Login Attempts Reloaded < 2.17.4 - Login Rate Limiting Bypass

When the plugin is configured with a custom header in its Trusted IP Origins setting e.g X-Forwarded-For, attackers could bypass the protection offered by tampering the header sent in requests...

CRLFuzz - A Fast Tool To Scan CRLF Vulnerability Written In Go

A fast tool to scan CRLF vulnerability written in Go Installation from Binary The installation is easy. You can download a prebuilt binary from releases page, unpack and run! or with $ curl -sSfL http://git.io/get-crlfuzz | sh -s -- -b /usr/local/bin from Source If you have go1.13+ compiler...

Bxss - A Blind XSS Injector Tool

ABlind XSS Injector tool Features Inject Blind XSS payloads into custom headers Inject Blind XSS payloads into parameters Uses Different Request Methods PUT,POST,GET,OPTIONS all at once Tool Chaining Really fast Easy to setup Install $ go get -u github.com/ethicalhackingplayground/bxss Arguments ...

Datapower Settings

This plugin just sets global variables for datapower TRUSTED...

CVE-2016-1000232

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0...

Toko Lite CMS 1.5.2 (edit.php) HTTP Response Splitting Vulnerability

No description provided by source. Toko Lite CMS 1.5.2 edit.php HTTP Response Splitting Vulnerability Vendor: Toko Product web page: http://toko-contenteditor.pageil.net Affected version: 1.5.2 Summary: Toko Web Content Editor cms is a compact, multi language, open source web editor and content...

CORS requests can omit the preflight request – Opera Security Advisories

Cross-Origin Resource Sharing CORS requests are required to send a preflight request if custom headers are included, to check that the host wishes to allow the full request to be made. An example of where this may be needed is for sites that use a custom header with a static value as part of thei...

8e6 Technologies R3000 Internet Filter Bypass with Host Decoy

8e6 Technologies R3000 Internet Filter Bypass with Host Decoy Product: 8e6 Technologies R3000 Internet Filter http://www.8e6.com/network-security/internet-filtering/internet-filtering.html The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter contains a...

Security Best Practice: Get Yourself Familiar with the Header Rejection Tool

Web servers and applications parse not only the URL, but also the rest of the HTTP header data. Wrong parsing can lead to buffer overrun attacks and other vulnerabilities. Some exploits use the HTTP headers to cause damage. The exploit can be carried in standard headers the Host header for exampl...