1882 matches found
CVE-2024-32384
Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device...
CVE-2025-64333
A flaw was found in Suricata. This vulnerability allows a stack overflow, leading to a crash, via a large HTTP Hypertext Transfer Protocol content type when logged...
The vulnerability of the REST WebServices component of the Oracle Identity Manager identity management system, a software platform of Oracle Fusion Middleware, allows a perpetrator to cause a service failure.
The vulnerability of the REST WebServices component of the Oracle Identity Manager identity management software from Oracle Fusion Middleware is related to the lack of authentication checks for a critical function. Exploiting this vulnerability could allow an attacker to cause service failures...
Suricata 安全漏洞
Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A security vulnerability exists in Suricata versions prior to 7.0.13 and prior to 8.0.2, which stems from a stack overflow during large HTTP file transfers that could lead to a crash...
EUVD-2025-199588
Security Point Windows of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege...
CVE-2025-36160
IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system...
TencentOS Server 3: go-toolset (TSSA-2023:0116)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0116 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
Security Bulletin: Eventlet Pre-0.40.3 HTTP Trailer Parsing Flaw Enables HTTP Request Smuggling
Summary Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch...
The vulnerability of the eventlet.wsgi module from the Eventlet library allows a hacker to bypass existing security restrictions.
The vulnerability of the eventlet.wsgi module of the Eventlet library is related to deficiencies in HTTP request handling. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
EUVD-2021-34720
ReQuest Serious Play F3 Media Server versions 7.0.3.4968 Pro, 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 contain a remote denial-of-service vulnerability. The device can be shut down or rebooted by an unauthenticated attacker through a single crafted HTTP GET request, allowing...
CVE-2025-20355 Cisco Catalyst Center Software HTTP Open Redirect Vulnerability
A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit...
PT-2026-6059
Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description An HTTP Request Smuggling issue exists in libsoup, an HTTP client/server library. The problem stems from non-RFC-compliant parsing within the soup filter input stream read line function,...
UBUNTU-CVE-2025-60876
BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...
CVE-2025-60876
BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...
CVE-2025-36249
IBM Jazz for Service Management versions 1.1.3.0–1.1.3.25 do not set the Secure attribute on authorization tokens or session cookies, enabling potential cookie theft via http links or injected sites. Remediation per IBM/Red Hat entries: upgrade to JazzSM 1.1.3.26 (1.1.3-TIV-JazzSM-multi-FP026). A...
The vulnerability of the AdvSetMacMtuWan() function in the microprogramming software for Tenda AC6 allows a hacker to trigger a service failure.
The vulnerability of the AdvSetMacMtuWan function in the Tenda AC6 router software lies in the fact that the operation’s output goes beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted HTTP request...
CVE-2025-61234
Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port...
Man-In-The-Middle (MITM)
Dragonfly is vulnerable to Man-in-the-Middle MitM attack. The vulnerability is due to the scheduler being hardcoded to use the insecure HTTP protocol for downloading tiny files, which allows an attacker to intercept and modify network requests to deliver malicious or altered data...
USN-7845-1 squid, squid3 vulnerability
Leonardo Giovannini discovered that Squid failed to redact HTTP Authentication credentials in a default configuration. An attacker could possibly use this issue to obtain sensitive information...