CVE-2022-24910

A buffer overflow vulnerability exists in the httpd parsepingresult API functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3), strapi-ent-a (0.1.0) +1 more potentially affected by CVE-2021-46440 via @strapi/strapi (>=4.0.0-beta.0, <=4.1.2)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =1.0.0-alpha.3 - strapi-ent-a 0.1.0 - sveltekit-strapi 0.1.0 Source cves: CVE-2021-46440 Source advisory: OSV:GHSA-85VG-GRR5-PW42...

Cisco Adaptive Security Appliances Software 缓冲区错误漏洞

Cisco Adaptive Security Appliances Software is a set of firewalls and network security platforms from the U.S. company Cisco Cisco. The platform provides highly secure access to data and network resources and other features. A buffer overflow vulnerability exists in the Cisco Adaptive Security...

UBUNTU-CVE-2022-24761

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

U.S. Dept Of Defense: HTTP Request Smuggling

hello dear support I have found HTTP Request Smuggling on www.████████ Issue description ============== HTTP request smuggling vulnerabilities arise when websites route HTTP requests through webservers with inconsistent HTTP parsing. By supplying a request that gets interpreted as being different...

amiwo (>=0.0.1, <=0.2.3), geoshaper (>=0.1.0, <=0.2.0) +8 more potentially affected by CVE-2021-29935 via rocket (>=0.1.6, <=0.2.11)

rocket CARGO version =0.1.6, =0.0.1, =0.1.0, =0.8.0, =0.15.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2021-29935 Source advisory: OSV:RUSTSEC-2021-0044...

USN-4558-1: libapreq2 vulnerabilities

It was discovered that libapreq2 did not properly sanitize the Content-Type field in certain, crafted HTTP requests. An attacker could use this vulnerability to cause libapreq2 to crash...

@commercial/hapi (19.0.2), @hapi/hapi (>=19.0.0, <=19.0.4) +7 more potentially affected by unknown CVE via @hapi/accept (4.0.1)

@hapi/accept NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/accept and may be impacted: - @commercial/hapi 19.0.2 - @hapi/hapi =19.0.0, =0.0.3, =0.27.0, =0.27.0, =0.9.0, =2.0.4, =5.0.2 Source cves: unknown CVE Source advisory:...

abrute (>=0.1.7, <=0.1.9), anterofit (>=0.0.1, <=0.0.2) +18 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.5.9)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.0.1, =0.0.1, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.5.0 and more Source cves: CVE-2020-35884 Source advisory: OSV:RUSTSEC-2020-0031...

Microsoft Edge Spoofing Vulnerability (CNVD-2020-61594)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge, which stems from the program's failure to properly parse HTTP content. An attacker could exploit the vulnerability to lure users by...

FreeBSD : Node.js -- multiple vulnerabilities (0032400f-624f-11ea-b495-000d3ab229d6)

Node.js reports : Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.j...

CentOS 7 : http-parser (RHSA-2020:0703)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0703 advisory. - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVE-2019-15605 Note that Nessus has not...

CentOS: Security Advisory for http-parser (CESA-2020:0703)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

February 2020 Security Releases

February 2020 Security Releases Update 6-February-2020 Security releases available Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.js versions can be...

Node.js -- multiple vulnerabilities

Node.js reports: Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.js...

CVE-2019-15276

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

CVE-2019-15276

CVE-2019-15276: Cisco Wireless LAN Controller HTTP parsing DoS . The vulnerability affects Cisco WLC software (versions 8.4–8.9, 8.10 fixed) where the HTTP parsing engine fails to handle specially crafted URLs. An attacker with low privileges (or a user who can be lured to click a crafted URL) ca...

CVE-2019-15276 Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

CVE-2019-15276 Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

UBUNTU-CVE-2019-17420

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the httpheader signature to not alert on a response with a single \r\n ending...