66 matches found
CVE-2022-25355
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users...
The vulnerability of the HttpObjectDecoder.java component of the Netty network programming framework, related to a deficiency in HTTP request interpretation, allows attackers to access confidential data and compromise its integrity.
The vulnerability of the HttpObjectDecoder.java component of the Netty network programming framework is related to the lack of checks for the presence of a semicolon in the HTTP header. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its...
ILM OpenEXR 代码问题漏洞
ILM OpenEXR is an image file format for High Dynamic Range HDR images from Industrial Light and Magic ILM. ILM OpenEXR suffers from a code issue vulnerability that stems from a flaw in the product's Imf25::Header::operator. The vulnerability can be exploited to execute malicious code. The followi...
UBUNTU-CVE-2020-24588
The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames which is mandatory as part of 802.11...
CVE-2019-20907
...
The vulnerability of the server software HAProxy arises from improper handling of HTTP headers during the conversion from HTTP/2 to HTTP/1. This allows attackers to access sensitive data, compromise its integrity, and cause service failures.
The vulnerability of server software such as HAProxy stems from improper handling of HTTP headers during the conversion from HTTP/2 to HTTP/1. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service failures...
CVE-2020-10404
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-field.php by adding a question mark ? followed by the payload...
Elastic Stack 6.8.7 and 7.6.1 security update
Kibana Node.js security flaws ESA-2020-01 The version of Node.js shipped in all versions of Kibana prior to 7.6.1 and 6.8.7 contain three security flaws. CVE-2019-15604 describes a Denial of Service DoS flaw in the TLS handling code of Node.js. Successful exploitation of this flaw could result in...
The vulnerability of the implementation of SMBv2 and SMBv3 protocols in Cisco Firepower System software allows a perpetrator to induce a service failure.
The vulnerability of the SMBv2 and SMBv3 protocols implemented by Cisco Firepower System arises from incorrect validation of the SMB message header. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
[SECURITY] [DSA 4292-1] kamailio security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4292-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 11, 2018 https://www.debian.org/security/faq -...
UBUNTU-CVE-2018-14767
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. The reason is missing input validation in the "buildresbuffromsipreq" core function. This could result in denial of service and potentially...
ALPINE-CVE-2017-12982
The bmpreadinfoheader function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service memory allocation failure in the opjimagecreate function in lib/openjp2/image.c, related to the opjalignedallocn...
Cisco IP Phone 8800 Series Denial of Service Vulnerability
Cisco IP Phone 8800 Series is a telephone product from Cisco USA that provides video and VoIP communication features. A denial of service vulnerability exists in the Session Initiation Protocol SIP call handling in the Cisco IP Phone 8800 Series, which arises from the program's failure to properl...
The vulnerability of the URLConnection class in the Android operating system allows a hacker to inject arbitrary scripts or set arbitrary values in cookies.
The vulnerability of the HTTP header of the URLConnection class in the Android operating system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary scripts or set arbitrary values in cookies remotely...
The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to obtain confidential information.
The vulnerability of the McAfee VirusScan Enterprise antivirus software arises from the failure to handle CRLF sequences in headers properly. Exploiting this vulnerability can allow a remote attacker to obtain confidential information...
CVE-2017-3824
A vulnerability in the handling of list headers in Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service DoS condition. Cisco cBR-8 Converged Broadband Routers running vulnerable versions of Cis...
Mozilla Firefox URL parsing implementation information disclosure vulnerability
Mozilla Firefox is an open source web browser. Mozilla Firefox's URL parsing implementation fails to properly recognize the slash character in the hostname in the Location header, allowing remote attackers to exploit this vulnerability to obtain sensitive information...
PT-2015-6600
Name of the Vulnerable Software and Affected Versions libmspack versions prior to 0.5 Description The issue is related to the chmd read headers function in chmd.c, which does not validate name lengths. This allows remote attackers to cause a denial of service, resulting in a buffer over-read and...
i-HTTPD vulnerable to cross-site scripting
Overview i-HTTPD is a web server for Windows. i-HTTPD contains a flaw in processing HTTP header, which may lead to cross-site scripting CWE-79. Note that this vulnerability is different from JVN89613370. Yamagata of webappsec.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the...