CVE-2022-2466

Summary: CVE-2022-2466 affects Quarkus 2.10.x due to incomplete termination of the HTTP request header context, enabling HTTP request smuggling as described in connected sources. The issue relates to the handle logic in SmallRyeGraphQLAbstractHandler.java and may cause unpredictable behavior. The...

CVE-2022-2466

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior...

EUVD-2022-6884

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior...

Denial Of Service (DoS)

connman is vulnerable to denial of service. The vulnerability exists due to the heap-based buffer overflow in receiveddata execute code, allowing an attacker to crash the application by sending the HTTP requests to the gweb component...

Gitlab -- multiple vulnerabilities

Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Content injection via Incidents Timeline description Lack of length validation in Snippets leads to Denial of Service Group IP allow-list not fully respected by the Package Registry Abusing Gitaly.GetTreeEntrie...

FreeBSD : Gitlab -- multiple vulnerabilities (e6b994e2-2891-11ed-9be7-454b1dd82c64)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e6b994e2-2891-11ed-9be7-454b1dd82c64 advisory. - Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Conte...

CVE-2022-20921

A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator MSO could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker could exploit this vulnerability by sendi...

Authorization

A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator MSO could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker could exploit this vulnerability by sendi...

Kirby CMS 2.5.12 Cross-site Scripting

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...

GHSA-H3W2-QG2R-C7MF Kirby CMS 2.5.12 Cross-site Scripting

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...

CVE-2018-14520

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...

CVE-2018-14520

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...

Code injection

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...

CVE-2018-14520

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...

USN-5576-1: Twisted vulnerability

It was discovered that Twisted incorrectly parsed some types of HTTP requests in its web server implementation. In certain proxy or multi-server configurations, a remote attacker could craft malicious HTTP requests in order to obtain sensitive information...

PT-2022-8036 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby version 2.5.12 Description: The issue allows malicious HTTP requests to be sent, which can trick a user into adding web pages. Recommendations: For Kirby version 2.5.12, at the moment, there is no information about a newer version that...

CVE-2022-32778

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the...

Information disclosure

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability...

CVE-2022-32778

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the...