CVE-2018-16789

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down...

Design/Logic Flaw

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down...

CUJO Smart Firewall safe browsing Host header-parsing firewall bypass vulnerability

Summary An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The “Host” header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit...

CVE-2018-16789

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down...

CVE-2018-16789

CVE-2018-16789 affects shellinabox up to version 2.20, where libhttp/url.c contains a flaw in HTTP request parsing. A crafted multipart/form-data request can cause shellinaboxd to enter an infinite loop, exhausting CPU resources and potentially taking the service down. The available documents des...

RHEL 7 : Red Hat JBoss Enterprise Application Platform (RHSA-2017:0245)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0245 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release of Red...

CVE-2018-3908: Inconsistent Interpretation of HTTP Requests

An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP...

Design/Logic Flaw

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating t...

CVE-2017-2666

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating t...

Virtuozzo 6 : tomcat6 / tomcat6-admin-webapps / etc (VZLSA-2017-0527)

An update for tomcat6 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Virtuozzo 7 : tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (VZLSA-2017-0935)

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2016-6816

CVE-2016-6816 affects multiple Tomcat branches (9.0.0.M1–M11, 8.5.0–8.5.6, 8.0.0.RC1–8.0.38, 7.0.0–7.0.72, 6.0.0–6.0.47). The vulnerability arises from parsing the HTTP request line with invalid characters, which could be combined with a proxy interpreting those chars differently to inject data i...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Cisco WSA Multiple Vulnerabilities 05/16

Cisco WSA Software is prone to multiple vulnerabilities. CVE-2016-1380 A vulnerability that occurs when parsing an HTTP POST request with Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS vulnerability due to the...

Microsoft Windows - HTTP.sys HTTP Request Parsing Denial of Service (MS15-034)

Microsoft Windows - HTTP.sys HTTP Request Parsing Denial of Service MS15-034 Tested on Win Srv 2012R2. import socket,sys if lensys.argv=1: sys.exit'Give me an IP' Host = sys.argv1 def SendPayloadPayload, Host: s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.connectHost, 80 s.sendPayload...

Microsoft Windows - 'HTTP.sys' HTTP Request Parsing Denial of Service (MS15-034)

Tested on Win Srv 2012R2. import socket,sys if lensys.argv=1: sys.exit'Give me an IP' Host = sys.argv1 def SendPayloadPayload, Host: s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.connectHost, 80 s.sendPayload s.recv1024 s.close Make sure iisstart.htm exist. Init = "GET /iisstart.htm...

Embedthis Appweb Web Server Remote Denial of Service Vulnerability

Embedthis Appweb Web Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DartWebserver buffer overflow

Buffer overflow on HTTP request parsing...

CoDeSys 3.4 - Null Pointer Invalid HTTP Request Parsing Remote Denial of Service

CoDeSys 3.4 - Null Pointer Invalid HTTP Request Parsing Remote Denial of Service source: https://www.securityfocus.com/bid/50854/info CoDeSys is prone to multiple denial-of-service vulnerabilities. An attacker can exploit these issues to crash the application and deny service to legitimate users...

CoDeSys 3.4 - Null Pointer Invalid HTTP Request Parsing Remote Denial of Service

source: https://www.securityfocus.com/bid/50854/info CoDeSys is prone to multiple denial-of-service vulnerabilities. An attacker can exploit these issues to crash the application and deny service to legitimate users. udpsz -T -c "BLAH / HTTP/1.0\r\n\r\n" SERVER 8080 -1...