CVE-2021-31349: Improper Authentication

The usage of an internal HTTP header created an authentication bypass vulnerability CWE-287, allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to...

Security Bulletin: Operations Dashboard is vulnerable to multiple Go vulnerabilities

Summary Operations Dashboard is vulnerable to multiple Go vulnerabilities with details of each below Vulnerability Details CVEID: CVE-2021-33197 DESCRIPTION: Golang Go could allow a remote attacker to bypass security restrictions, caused by a flaw in the ReverseProxy in net/http/httputil. By...

Cybozu Remote Service HTTP Header Injection Vulnerability

Cybozu Remote Service is a remote service management software used to access Cybozu's internal systems by Cybozu Japan.Cybozu Remote Service is vulnerable to HTTP header injection. A remote attacker can use this vulnerability to alter information stored in the product...

CVE-2021-20802

HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product...

Design/Logic Flaw

HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product...

CVE-2021-20802

CVE-2021-20802 affects Cybozu Remote Service versions 3.1.8–3.1.9 and is an HTTP header injection vulnerability (CWE-113) that can let a remote attacker alter information stored in the product. The issue is documented across multiple sources (NVD, JVN, Red Hat, CNVD, CNVD, etc.). The confirmed im...

CVE-2021-20802

HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product...

CVE-2021-20802: Improper Neutralization of Special Elements in Output Used by a Downstream Component

HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product...

PT-2021-14256

Name of the Vulnerable Software and Affected Versions: Cybozu Remote Service versions 3.1.8 through 3.1.9 Description: The issue allows a remote attacker to alter the information stored in the product due to an HTTP header injection vulnerability. Recommendations: For Cybozu Remote Service versio...

CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using "puma" with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

CVE-2021-41136: Inconsistent Interpretation of HTTP Requests

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

CVE-2021-41130

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...

Authorization

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...

CVE-2021-41130

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...

CVE-2021-42071

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

Command injection

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-42071

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-42071

CVE-2021-42071 affects Visual Tools DVR VX16 4.2.28.0. An unauthenticated attacker can achieve remote code execution by exploiting shell metacharacters in the cgi-bin/slogin/login.py User-Agent header, via an OS command-injection vector. Exploitation has been demonstrated in public disclosures (E...

CVE-2021-41130: Authentication Bypass by Spoofing

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...

TYPO3 HTTP Host Header Injection Vulnerability (TYPO3-CORE-SA-2021-015)

TYPO3 is prone to an HTTP host header injection vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; if...