297 matches found
PT-2022-3606 · Node.Js +8 · Node.Js +8
Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 14.20.1 Node.js versions prior to 16.17.1 Node.js versions prior to 18.9.1 Description: The issue is related to the llhttp parser in the http module in Node.js, which does not strictly use the CRLF sequence to delimi...
curl: CVE-2022-35252: control code in cookie denial of service
Summary: I took a look at https://github.com/curl/curl/pull/9048/commits/d7bcbc7d8d4b6d972d3da12d54819169a19c287b a sneak peek on a vulnerability to be announced tomorrow. My guess for that vulnerability is that since cookies are persistent, someone who can trick curl into storing cookies can sto...
CVE-2022-26377
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions...
CVE-2019-20445
A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...
Exploit for Stack-based Buffer Overflow in Paloaltonetworks Pan-Os
CVE-2021-3064: Pan-OS Remote Buffer Overflow + HTTP Smuggling...
USN-5371-1 nginx vulnerabilities
It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue was fixed for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2020-11724 It was discovered that nginx Lua module mishandled certain input...
Apache 2.4.x < 2.4.53 Multiple Vulnerabilities
According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.53. It is, therefore, affected by multiple vulnerabilities: - A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. CVE-2022-22719 - A HTTP...
D-Link Dir-X1860 Denial of Service Vulnerability (CNVD-2022-38536)
The D-Link Dir-X1860 is a dual-band router from D-Link, a Chinese company. The D-Link DIR-X1860 suffers from a denial-of-service vulnerability that stems from the lack of HTTP packet authentication and filtering in the software web application leading to HTTP smuggling attacks, which can be...
CVE-2021-41442
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...
CVE-2021-41442
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...
CVE-2021-41442
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...
Design/Logic Flaw
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...
CVE-2021-41442
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...
CVE-2021-41442
Affected product: D-Link DIR-X1860 router (web application). Vulnerability: HTTP smuggling allows remote unauthenticated attacker to DoS the web interface by sending crafted HTTP packets. Affected version: prior to v1.10WWB09_Beta. Root cause: inadequate handling of HTTP requests in the web appli...
llhttp: HTTP Request Smuggling when parsing the body of chunked requests
An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...
The Bug Report November 2021 Edition
The Bug Report — November 2021 Edition By Mark Bereza · November 30, 2021 Your Cybersecurity Comic Relief CVE-2021-20322: Of all the words of mice and men, the saddest are, “it was DNS again.” Why am I here? For all our newcomers, welcome to the Advanced Threat Research team’s monthly bug report ...
Palo Alto Warns of Zero-Day Bug in Firewalls Using GlobalProtect Portal VPN
A new zero-day vulnerability has been disclosed in Palo Alto Networks GlobalProtect VPN that could be abused by an unauthenticated network-based attacker to execute arbitrary code on affected devices with root user privileges. Tracked as CVE-2021-3064 CVSS score: 9.8, the security weakness impact...
Massive Zero-Day Hole Found in Palo Alto Security Appliances
Researchers have developed a working exploit to gain remote code execution RCE via a massive vulnerability in a security appliance from Palo Alto Networks PAN, potentially leaving 10,000 vulnerable firewalls with their goods exposed to the internet. The critical zero day, tracked as CVE 2021-3064...
OESA-2021-1422 undertow security update
Java web server using non-blocking IO Security Fixes: A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using...
CLSA-2021-1634925600 Fixed CVEs in squid: CVE-2020-15049, CVE-2020-14058
CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service - CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack...