PT-2024-3722 · Oracle · Oracle Complex Maintenance

Name of the Vulnerable Software and Affected Versions: Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the LOV component of Oracle Complex Maintenance, Repair, and Overhaul, allowing an...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox version 125, which stems from a lack of a limit on the number of HTTP/2 CONTINUATION frames that need to be processed, which could lead to memory...

SUSE SLES12 Security Update : nghttp2 (SUSE-SU-2024:1156-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1156-1 advisory. - CVE-2024-28182: Fixed denial of service via http/2 continuation frames bsc1221399 Tenable has extracted the preceding description block...

HTTP/2 CONTINUATION flood in net/http

...

The vulnerability lies in the implementation of the HTTP/2 utility in the command-line tool cURL, which allows a attacker to cause a service failure.

The vulnerability of the HTTP/2 command-line utility implementation in CURL is related to memory leak errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the Apache HTTP Server web server, related to uncontrolled resource consumption, allows attackers to cause service interruptions.

The vulnerability of the Apache HTTP Server’s web server in terms of the implementation of the HTTP/2 protocol is related to an uncontrolled resource consumption due to incorrect determination of the end of headers during the processing of CONTINUATION requests. Exploiting this vulnerability can...

AZL-38233 CVE-2023-45288 affecting package jx for versions less than 3.10.116-2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-39505 CVE-2023-45288 affecting package node-problem-detector for versions less than 0.8.17-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-38473 CVE-2023-45288 affecting package prometheus-node-exporter for versions less than 1.7.0-2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

The vulnerability of the Apache Tomcat application server, related to insufficient input validation, allows attackers to cause service failures.

The vulnerability of the Apache Tomcat application server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to cause service failures through specially crafted HTTP/2 requests...

PT-2024-2623 · Tempesta · Tempesta

Name of the Vulnerable Software and Affected Versions: Tempesta affected versions not specified Description: The issue is related to a firewall vulnerability in the implementation of the HTTP/2 protocol, specifically concerning the handling of CONTINUATION frames. This can lead to an uncontrolled...

python-aiohttp: numerous issues in HTTP parser with header parsing

An HTTP request smuggling vulnerability was found in aiohttp. Numerous issues with HTTP parsing can allow an attacker to smuggle HTTP requests...

The vulnerability of the aiohttp HTTP client, related to deficiencies in handling HTTP request headers, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the aiohttp HTTP client is related to deficiencies in the handling of HTTP request headers. Exploiting this vulnerability allows an attacker to send hidden HTTP requests remotely HTTP Request Smuggling attack...

The vulnerability of the Captive Portal authentication system for operating systems FortiOS and proxy servers, designed to protect against Internet attacks by FortiProxy, allows a perpetrator to execute arbitrary codes or commands.

The vulnerability of Captive Portal for FortiOS operating systems and proxy servers, designed to protect against Internet attacks using FortiProxy, is related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or commands through...

UBUNTU-CVE-2024-24568

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3...

Weston Embedded uC-HTTP Security Vulnerability

Weston Embedded uC-HTTP is an embedded HTTP service from Weston Embedded. A security vulnerability exists in Weston Embedded uC-HTTP that stems from a heap-based buffer overflow vulnerability in the HTTP server functionality...

The vulnerability of the implementation of the PPTP protocol by the microprogramming-based VPN router TP-Link ER7206 Omada allows a perpetrator to execute arbitrary commands.

The vulnerability of the PPTP protocol implementation in the TP-Link ER7206 Omada VPN router software exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through ports 80/443 remotely...

CVE-2024-20947

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

The vulnerability of the http parser() function in the Apache bRPC RPC framework allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the http parser function in the Apache bRPC RPC framework is related to a discrepancy in the RFC-7230 HTTP 1.1 specification regarding the handling of HTTP requests when processing fields such as Transfer-Encoding and Content-Length. Exploiting this vulnerability allows an...

The vulnerability of HTTP/3 QUIC modules in NGINX Plus and NGINX OSS web servers allows attackers to cause service interruptions.

The vulnerability of HTTP/3 QUIC in NGINX Plus and NGINX OSS web servers is related to the swapping of the zero pointer. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending specially crafted requests...