375 matches found
CVE-2016-9938
An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chansip channel driver has a liberal definition for whitespace when attempting to strip the content betwe...
Cisco FireSIGHT System Software Snort Rule Bypass Vulnerability
Cisco FireSIGHT System Software is the United States Cisco Cisco company's set of management center software, which supports the centralized management of the use of FirePOWER Services Cisco ASA and Cisco FirePOWER network security appliances network security and operational functions of the...
Python Injection of Arbitrary HTTP Headers Vulnerability
Python is an open source, object-oriented programming language. Python's urrlib2/urllib/httplib/http.client file 'HTTP Connection.putheader' function uses insecure characters that allow remote attackers to exploit vulnerabilities to inject arbitrary HTTP headers for spoofing attacks...
LogicalDoc Document Managment System CE: source code security analysis report
Several vulnerabilities were discovered in LogicalDOC 'LogicalDoc Document Managment System CE' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из...
The vulnerability of the PHP interpreter allows attackers to execute arbitrary code.
The vulnerability of the SoapClient call function in the serializefunctioncall function ext/soap/soap.c in the PHP interpreter is related to improper handling of headers. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using specially crafted packets, which cause ...
Medium: php-ZendFramework
Issue Overview: Upstream reported http://framework.zend.com/security/advisory/ZF2015-04 a vulnerability in the Zend\Mail component in Zend Framework 2, specifically in how it handles headers. Headers are not correctly filtered for newlines, allowing the ability to send additional, unrelated heade...
Apple iOS TCP Header Handling Denial of Service Vulnerability
Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A denial of service issue exists in the Apple iOS kernel's handling of TCP headers, allowing remote attackers to exploit the vulnerability for denial of service attacks...
mutt: denial of service
The writeoneheader function does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service crash via a header with an empty body, which triggers a heap-based buffer overflow in the muttsubstrdup function...
rubygem-actionpack: Action View DoS
A denial of service flaw was found in the header handling component of Action View. A remote attacker could send strings in specially crafted headers that would be cached indefinitely, which would result in all available system memory eventually being consumed...
IBM WebSphere Application Server 7.0 < Fix Pack 35 Multiple Vulnerabilities
The remote host is running a version of IBM WebSphere Application Server 7.0 prior to Fix Pack 35. It is, therefore, affected by the following vulnerabilities : - Multiple errors exist related to the included IBM HTTP server that could allow remote code execution or denial of service...
USN-2347-1: Django vulnerabilities
Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...
Microsoft Internet Explorer 7.0 - Header Handling 'res://' Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/28667/info Microsoft Internet Explorer is prone to an information-disclosure vulnerability. An attacker can exploit this issue to obtain potentially sensitive information from the local computer. Information obtained may...
Microsoft Reader <= 2.1.1.3143 Integer Overflow
No description provided by source. Source: http://aluigi.org/adv/msreader1-adv.txt Luigi Auriemma Application: Microsoft Reader http://www.microsoft.com/reader Versions: = 2.1.1.3143 PC version the Origami 2.6.1.7169 version doesn't seem vulnerable the non-PC versions have not been tested...
USN-2212-1 python-django vulnerabilities
Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby discovered that Django improperly removed Vary and Cache-Control headers from HTTP responses when replying to a request from an Internet Explorer or Chrome Frame client. An attacker may use this to retrieve private data or poison...
rubygem-actionpack: Action View DoS
A denial of service flaw was found in the header handling component of Action View. A remote attacker could send strings in specially crafted headers that would be cached indefinitely, which would result in all available system memory eventually being consumed...
Tinyproxy: Denial of service
Background Tinyproxy is a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems. Description A vulnerability has been discovered in the way how Tinyproxy works with headers. Impact A remote attacker could send a specially crafted request with too many headers, possibly resulting in a...
PHP: sapi_header_op() %0D sequence handling security bypass
The sapiheaderop function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences aka carriage return characters, which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction betwe...
rubygem-actionpack: Action View DoS
A denial of service flaw was found in the header handling component of Action View. A remote attacker could send strings in specially crafted headers that would be cached indefinitely, which would result in all available system memory eventually being consumed...
Denial of Service Vulnerability in Action View
There is a denial of service vulnerability in the header handling component of Action View...
MiniUPnPd 1.0 Stack Buffer Overflow Remote Code Execution
This module exploits the MiniUPnP 1.0 SOAP stack buffer overflow vulnerability present in the SOAPAction HTTP header handling. Module Options msf use exploit/linux/upnp/miniupnpd/soapbof msf undefinedsoapbof show actions ...actions... msf undefinedsoapbof set ACTION msf undefinedsoapbof show...