HTTP Request Smuggling

Go is vulnerable to HTTP request smuggling. The vulnerability is due to a lack of sanitizations in the query parameter for ReverseProxy. Remote attackers can cause query parameter smuggling when a go proxy forwards a parameter with an unparseable value...

Server side request forgery (ssrf)

The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a...

CVE-2022-36802

The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a...

Amazon Linux 2 : runc (ALASDOCKER-2022-020)

The version of runc installed on the remote host is prior to 1.1.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2022-020 advisory. Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4...

HTTP Request Smuggling

Gunicorn is vulnerable to HTTP request smuggling. The vulnerability exists in parsechunksize of body.py due to discrepancies in parsing HTTP requests which allows an attacker to smuggle HTTP requests...

HTTP Request Smuggling

Gunicorn is vulnerable to HTTP request smuggling. The vulnerability is due the function setbodyreader in message.py. Due to enforcing the content length when the web socket key was received without relying on the headers provided in the request allows an attacker to smuggle HTTP request via...

SUSE-SU-2022:3571-1 Security update for rubygem-puma

This update for rubygem-puma fixes the following issues: Updated to version 4.3.12: - CVE-2022-24790: Fixed HTTP request smuggling if proxy is not RFC7230 compliant bsc1197818...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-2564)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerability Spotlight: Data deserialization in VMware vCenter could lead to remote code execution

Marcin "Icewall" Noga of Cisco Talos discovered this vulnerability. Cisco Talos recently discovered an exploitable data deserialization vulnerability in the VMware vCenter server platform. VMware is one of the most popular virtual machine solutions currently available, and its vCenter software...

ZKTeco ZKBioSecurity Access Control Error Vulnerability

ZKTeco ZKBioSecurity is a web-based all-in-one platform from ZKTeco China.An access control error vulnerability exists in ZKTeco ZKBioSecurity V5000 version 3.0.5r. The vulnerability stems from the presence of improper access control in the application, which can be exploited by an attacker to...

PT-2022-6037

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.82 Apache Tomcat versions 9.0.0-M1 through 9.0.67 Apache Tomcat versions 10.0.0-M1 through 10.0.26 Apache Tomcat versions 10.1.0-M1 through 10.1.0 Description The issue is related to the implementation ...

Amazon Linux 2 : golist (ALAS-2022-1847)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1847 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A...

Information Exposure

Tinyproxy is vulnerable to information exposure.The vulnerability exists in processrequest function due to the lack of processing of the HTTP request lines which allows attackers to exploit this vulnerability to access sensitive information at system runtime...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-2506)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-5371-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : golang, --advisory ALAS2-2022-1846 (ALAS-2022-1846)

The version of golang installed on the remote host is prior to 1.18.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1846 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A...

NocoDB Resource Management Error Vulnerability

NocoDB is an open source Airtable replacement. A resource management error vulnerability exists in versions of NocoDB prior to 0.92.0, which stems from allowing the insertion of large characters into the input field "New Project" in the creation field. ", an attacker could use this vulnerability ...

VMware vCenter Server Platform Services Controller Unsafe Deserialization vulnerability

Talos Vulnerability Report TALOS-2022-1587 VMware vCenter Server Platform Services Controller Unsafe Deserialization vulnerability October 10, 2022 CVE Number CVE-2022-31680 SUMMARY An unsafe deserialization vulnerability exists in the Platform Services Controller functionality of VMware vCenter...

EulerOS Virtualization 3.0.6.6 : httpd (EulerOS-SA-2022-2506)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. T...

AlmaLinux 8 : nodejs:14 (ALSA-2022:6448)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:6448 advisory. nodejs: DNS rebinding in --inspect via invalid IP addresses CVE-2022-32212 nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding...