FortiWeb - header injection in FortiWeb API

An improper neutralization of CRLF sequences in HTTP headers 'HTTP Response Splitting' vulnerability CWE-113 In FortiWeb API may allow an authenticated and remote attacker to inject arbitrary headers...

Fedora 35 : ruby (2022-b9b710f199)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-b9b710f199 advisory. Upgrade to Ruby 3.0.5. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 36 : ruby (2022-ef96a58bbe)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ef96a58bbe advisory. Upgrade to Ruby 3.1.3. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Mageia: Security Advisory (MGASA-2022-0454)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

Input validation

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

HTTP Response Splitting

netty-codec-http is vulnerable to HTTP response splitting attack. The vulnerability exists in the setObject function of DefaultHeaders.java as it takes the arrays and iterators as arguments, providing a way to bypass value validation allowing an attacker to inject malicious header values into the...

CVE-2022-41915: Interpretation Conflict

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

CVE-2022-41915

CVE-2022-41915 (Netty) : Netty versions 4.1.83.Final through 4.1.85.Final are affected. When calling DefaultHttpHeaders.set with an Iterator, header value validation was not performed, enabling HTTP Response Splitting via malicious iterator values. This is patched in 4.1.86.Final. Remediation/wor...

CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling "DefaultHttpHeadesr.set" with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

Netty 安全漏洞

Netty is a non-blocking I/O client-server framework from the Netty community that is primarily used for developing Java web applications such as protocol servers and clients. A security vulnerability exists in Netty versions prior to 4.1.86, which stems from the fact that header value validation ...

Netty vulnerable to HTTP Response splitting from assigning header value iterator

Impact When calling DefaultHttpHeaders.set with an iterator of values as opposed to a single given value, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. Patches The necessary validation was added in Netty 4.1.86.Fina...

GHSA-HH82-3PMQ-7FRP Netty vulnerable to HTTP Response splitting from assigning header value iterator

Impact When calling DefaultHttpHeaders.set with an iterator of values as opposed to a single given value, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. Patches The necessary validation was added in Netty 4.1.86.Fina...

HTTP Response Splitting

ruby is vulnerable to http response splitting. The vulnerability exists when applications use untrusted user input either to generate an HTTP response or to create a cgi cookie object...

Slackware: Security Advisory (SSA:2022-328-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : rubygem-cgi -- HTTP response splitting vulnerability (84ab03b6-6c20-11ed-b519-080027f5fec9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 84ab03b6-6c20-11ed-b519-080027f5fec9 advisory. - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response...