CVE-2022-24910

A buffer overflow vulnerability exists in the httpd parsepingresult API functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3), strapi-ent-a (0.1.0) +1 more potentially affected by CVE-2021-46440 via @strapi/strapi (>=4.0.0-beta.0, <=4.1.2)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =1.0.0-alpha.3 - strapi-ent-a 0.1.0 - sveltekit-strapi 0.1.0 Source cves: CVE-2021-46440 Source advisory: OSV:GHSA-85VG-GRR5-PW42...

Cisco Adaptive Security Appliances Software 缓冲区错误漏洞

Cisco Adaptive Security Appliances Software is a set of firewalls and network security platforms from the U.S. company Cisco Cisco. The platform provides highly secure access to data and network resources and other features. A buffer overflow vulnerability exists in the Cisco Adaptive Security...

UBUNTU-CVE-2022-24761

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

suricata:fuzz_applayerparserparse: Stack-buffer-overflow in htp_validate_hostname

Project: https://github.com/OISF/suricata.git Detailed Report: https://oss-fuzz.com/testcase?key=4669270932455424 Project: suricata Fuzzing Engine: libFuzzer Fuzz Target: fuzzapplayerparserparse Job Type: libfuzzerasansuricata Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash...

U.S. Dept Of Defense: HTTP Request Smuggling

hello dear support I have found HTTP Request Smuggling on www.████████ Issue description ============== HTTP request smuggling vulnerabilities arise when websites route HTTP requests through webservers with inconsistent HTTP parsing. By supplying a request that gets interpreted as being different...

amiwo (>=0.0.1, <=0.2.3), geoshaper (>=0.1.0, <=0.2.0) +8 more potentially affected by CVE-2021-29935 via rocket (>=0.1.6, <=0.2.11)

rocket CARGO version =0.1.6, =0.0.1, =0.1.0, =0.8.0, =0.15.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2021-29935 Source advisory: OSV:RUSTSEC-2021-0044...

USN-4558-1: libapreq2 vulnerabilities

It was discovered that libapreq2 did not properly sanitize the Content-Type field in certain, crafted HTTP requests. An attacker could use this vulnerability to cause libapreq2 to crash...

@commercial/hapi (19.0.2), @hapi/hapi (>=19.0.0, <=19.0.4) +7 more potentially affected by unknown CVE via @hapi/accept (4.0.1)

@hapi/accept NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/accept and may be impacted: - @commercial/hapi 19.0.2 - @hapi/hapi =19.0.0, =0.0.3, =0.27.0, =0.27.0, =0.9.0, =2.0.4, =5.0.2 Source cves: unknown CVE Source advisory:...

abrute (>=0.1.7, <=0.1.9), anterofit (>=0.0.1, <=0.0.2) +18 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.5.9)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.0.1, =0.0.1, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.5.0 and more Source cves: CVE-2020-35884 Source advisory: OSV:RUSTSEC-2020-0031...

CVE-2020-1059: URL Redirection to Untrusted Site

A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a piv...

Microsoft Edge Spoofing Vulnerability (CNVD-2020-61594)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge, which stems from the program's failure to properly parse HTTP content. An attacker could exploit the vulnerability to lure users by...

FreeBSD : Node.js -- multiple vulnerabilities (0032400f-624f-11ea-b495-000d3ab229d6)

Node.js reports : Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.j...

CentOS 7 : http-parser (RHSA-2020:0703)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0703 advisory. - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVE-2019-15605 Note that Nessus has not...

CentOS: Security Advisory for http-parser (CESA-2020:0703)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

February 2020 Security Releases

February 2020 Security Releases Update 6-February-2020 Security releases available Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.js versions can be...

Node.js -- multiple vulnerabilities

Node.js reports: Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.js...

CVE-2019-15276

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

CVE-2019-15276 Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

CVE-2019-15276 Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...