513 matches found
Heap-based Buffer Overflow
libsndfile is vulnerable to heap-based buffer overflow. This is due to the wrong management of the headindex and headend values while parsing AIFF header values. An attacker is able to exploit this vulnerability to overwrite memory heap by manipulating index values to use memcpy via a malicious...
Unspecified vulnerability in Http-signature
Http-signature is a library that includes client and server components with the Joyent HTTP signature scheme. A security vulnerability exists in Http-signature version 0.9.11 and earlier. An attacker can exploit this vulnerability by intercepting a request and replacing the packet header name and...
Quest KACE System Management Appliance Critical Function Insufficient Authorization Vulnerability
Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A critical function under-authorization vulnerability exists in Quest KACE System Management Appliance version 8.0.318. An attacker can exploit this vulnerability by modifying the 'Host' and...
X (Formerly Twitter): Account Takeover in Periscope TV
Summary: When you login periscope.tv using twitter, and change the host header from www.periscope.tv to attacker.com/www.periscope.tv, the oauth redirect destination will be attacker.com/www.periscope.tv, thus allowing attacker to send the oauth authorize link to victim, and takeover their accoun...
CVE-2017-4928
The flash-based vSphere Web Client 6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers toward...
Mail.ru: Unupdated ImageMagic leads to uninitialized server memory disclosure
It was possible to disclosure the part of server memory from uncontrolled location on account.my.com project via uploaded GIF image header manipulation. account.my.com is not currently in the Bug Bounty scope, reward was paid as a bonus due to potential severity. CVE-2017-15277...
Moxa AWK-3131A web_runScript Header Manipulation Denial of Service Vulnerability(CVE-2016-8726)
Summary An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web...
Email Before Download < 4.0 - SMTP Header Injection
Email Before Download https://wordpress.org/plugins/email-before-download/ before version 4.0 was vulnerable to an SMTP header injection which allows abuse of vulnerable website to send spam or phishing emails. In email-before-download.php, the "emailFrom" variable comes directly from the...
Moxa AWK-3131A web_runScript Header Manipulation Denial of Service Vulnerability
Summary An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web...
Access Restriction Bypass Via Origin Spoof
Origin headers are utilised by proxies and/or load balancers to track the originating IP address of the client. As the request progresses through a proxy, the origin header is added to the existing headers, and the value of the client's IP is then set within this header. Occasionally, poorly...
snoopy: incomplete fixes for command execution flaws
Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers...
snoopy: incomplete fixes for command execution flaws
Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers...
headers containing newline characters can split messages
Serializing of headers to the socket did not filter the values for newline bytes \r or \n, which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an...
CVE-2016-9028
Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header...
CVE-2016-9028
Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header...
Design/Logic Flaw
Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header...
CVE-2016-9028
Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header...
CVE-2016-9028
The CVE-2016-9028 issue affects Citrix NetScaler ADC (various 10.x/11.x builds) and enables an unauthenticated, remote attacker to steal session cookies by manipulating the Host header in an unauthorized redirect flow. Affected versions include 10.1 <135.8, 10.5 <61.11, 11.0 <65.31/65.35...
Nextcloud: Bypassing quota limit
Hi an user can upload files despite having a limited quota by changing value of "OC-Total-Length" in header to "A" or adding "X-Expected-Entity-Length" in header with "A" value in normal insuffisant storage we have: PUT /remote.php/webdav/a.jpg HTTP/1.1 Content-Type: application/octet-stream...
SUSE-SU-2016:1818-1 Security update for apache2
This update for apache2 fixes the following issues: It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-5387. As a result, these server components would...