CVE-2016-9205

A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to crash, resulting in a denial of service DoS condition. More Information: CSCvb14425. Known Affected Releases:...

Cisco IOS XR Software Denial of Service Vulnerability (CNVD-2016-12410)

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. A denial of service vulnerability exists in Cisco IOS XR Software's handling of HTTP 2.0 requests, which allows remote attackers to exploit the vulnerability by submitting a special...

OpenJDK: insufficient checks of JDWP packets (Hotspot, 8159519)

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol JDWP packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP request...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker coul...

CVE-2016-6839

CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

HTTP Information Disclosure Vulnerability

HTTP HyperText Transfer Protocol is one of the most widely used network protocols on the Internet. HTTP was designed to provide a means of publishing and receiving HTML pages, and the resources requested through the HTTP protocol are identified by Uniform Resource Identifiers URIs.HTTP/2 is one o...

Siemens SIPROTEC 4/SIPROTEC Compact Denial of Service Vulnerability

SIPROTEC 4 and SIPROTEC Compact devices provide a wide range of centralized protection, control and automation functions for substations and other applications. A denial of service vulnerability exists in Siemens SIPROTEC 4, SIPROTEC Compact devices, versions prior to EN100 Ethernet 4.29. A remot...

UBUNTU-CVE-2016-5137

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs,...

The vulnerability of the Cisco Wireless LAN Controller 4100 software allows for circumventing access restrictions.

Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to the widespread use of the Aironet IOS software. This leads to a state where the controller acts as an administrative HTTP server. Exploiting this vulnerability allows malicious actors to bypass access restrictions by...

DEBIAN-CVE-2016-5301

The parsechunkheader function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service crash via a crafted 1 HTTP response or possibly a 2 UPnP broadcast...

Multiple Huawei OceanStor Products Transmitting Token in Plaintext Vulnerability

Huawei OceanStor 5300 and others are storage products from Huawei, a Chinese company. A security vulnerability exists in multiple Huawei OceanStor products, which originates from a program sending session tokens in plaintext in HTTP headers. A remote attacker could exploit the vulnerability by...

Cisco RV110W/RV130W/RV215W Routers HTTP Request Buffer Overflow Vulnerability (CNVD-2016-04097 )

The Cisco RV130W Wireless-N is a multifunction VPN router; the Cisco RV110W/RV215W is a router that combines wired/wireless network connectivity, VPN, and firewall features. The Cisco RV110W/RV130W/RV215W routers have an HTTP request buffer overflow vulnerability that allows an unauthenticated,...

Trend Micro Worry-Free Business Security and Worry-Free Business Security Services HTTP Header Injection Vulnerability

Trend Micro Worry-Free Business Security and Worry-Free Business Security Services are both antivirus programs from Trend Micro. An HTTP header injection vulnerability exists in Trend Micro Worry-Free Business Security version 9.0 and Worry-Free Business Security Services version 5.x, which can b...

squid: Header Smuggling issue in HTTP Request processing

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...

squid: Cache poisoning issue in HTTP Request handling

An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid...

Apple iOS/watchOS and OS X El Capitan MapKit Sensitive Information Disclosure Vulnerability

Apple iOS is an operating system on Apple's cell phones. oS X El Capitan is a specialized operating system developed for Mac computers. watchOS is a smartwatch operating system. Apple iOS\watchOS and OS X El Capitan's MapKit fails to properly handle HTTP and HTTPS requests, allowing an attacker t...

Microsoft Windows HTTP.sys Denial of Service Vulnerability

Microsoft Windows 10 is a set of next-generation cross-platform operating systems released by the U.S.-based Microsoft Corporation Microsoft for PCs and laptops, tablets, and cell phones, among other devices. A denial of service vulnerability exists in the HTTP 2.0 protocol stack HTTP.sys in...

The vulnerability of the Cisco Firepower Extensible Operating System allows a perpetrator to gain access to read the files.

The vulnerability of the Cisco Firepower Extensible Operating System is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to files through a specially crafted HTTP request...

The vulnerability of the Internet Explorer browser, which allows a hacker to bypass the protection against cross-site scripting attacks

The vulnerability of the Internet Explorer browser is caused by errors in the processing of HTTP responses. Exploiting this vulnerability allows a malicious actor to bypass security measures against cross-site scripting attacks from a remote location...