151 matches found
EUVD-2008-1777
Malware in sbrugna...
EUVD-2009-3089
Malware in sbrugna...
CVE-2024-52520
Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and...
DEBIAN-CVE-2024-33452
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request...
UBUNTU-CVE-2024-33452
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request...
CVE-2024-33452
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request...
OpenResty lua-nginx-module security vulnerability
OpenResty lua-nginx-module is an OpenResty USA open source component for integrating the Lua scripting language into Nginx servers. A security vulnerability exists in OpenResty lua-nginx-module v0.10.26 and earlier versions, which stems from a specially crafted HEAD request that results in an...
CVE-2024-33452
The OpenResty lua-nginx-module (v.0.10.26 and before) contains a flaw allowing a remote attacker to conduct HTTP request smuggling via a crafted HEAD request . This vulnerability, identified as CVE-2024-33452 , can be leveraged to bypass frontend proxy protections, serve malicious responses to us...
CVE-2024-33452: Inconsistent Interpretation of HTTP Requests
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request...
GHSA-RV78-QQRQ-73M5 Directus's S3 assets become unavailable after a burst of HEAD requests
Summary There's some tools that use Directus to sync content and assets. Some of those tools use HEAD method, like Shopify, to check the existence of files. Although, when making many HEAD requests at once, at some point, all assets are being served as 403. Details When I was investigating this...
CVE-2025-30350
Directus and its storage-driver-s3 component are affected by a DoS-like asset unavailability vulnerability triggered by a burst of HEAD requests. Affected range: @directus/storage-driver-s3 versions prior to 12.0.1 (corresponding to Directus 9.22.0–11.5.0). When many HEAD checks occur, assets can...
CVE-2024-8062
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a "HEAD" request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an...
CVE-2024-8062: Synchronous Access of Remote Resource without Timeout
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a HEAD request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controll...
H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a HEAD request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controll...
Nextcloud Resource Management Error Vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from a resource management error vulnerability that stems from the fact that due to a pre-sent HEAD request, the link reference provider...
CVE-2024-11494
UNSUPPORTED WHEN ASSIGNED The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP20140331 could allow an unauthenticated attacker to read some device information via a crafted HTTP HEAD method...
CVE-2024-52520
Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and...
CVE-2024-52520
Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and...
CVE-2024-52520: Uncontrolled Resource Consumption
Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and...
NextCloud resource management error vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from a resource management error vulnerability that stems from the fact that due to a pre-sent HEAD request, the link reference provider...