Tyler Odyssey 信任管理问题漏洞

Tyler Technologies Tyler Odyssey is a court and judicial software system from Tyler Technologies, USA. Tyler Odyssey suffers from a security vulnerability that stems from passing unencrypted bytes from an intermediary to a client An intermediary attacker can inject an incorrect response to the...

golang: net/http: improper sanitization of Transfer-Encoding header

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid...

CVE-2022-1705 Improper sanitization of Transfer-Encoding headers in net/http

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid...

CVE-2022-29254 Failed payment recorded has completed in silverstripe/silverstripe-omnipay

silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways those that use intermediary states like isNotification or isRedirect, if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as...

F5 Networks BIG-IP : Eclipse Jetty vulnerabilities (K10002140)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K10002140 advisory. - In Eclipse Jetty, versions 9.2.x and older, 9.3.x all configurations, and 9.4.x non-default configuration wi...

CVE-2022-22536

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the...

CVE-2022-22536

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the...

Design/Logic Flaw

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the...

Cisco Small Business 缓冲区错误漏洞

Cisco Small Business is a switch from Cisco USA. A buffer error vulnerability exists in the Cisco Small Business RV Series Routers that stems from insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious input to an affected device...

CVE-2021-20042

An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances...

Advisory ROSA-SA-2021-1958

Software: pywbem 0.7.0 OS: Cobalt 7.9 CVE-ID: CVE-2013-6418 CVE-Crit: HIGH CVE-DESC: PyWBEM 0.7 and earlier versions use a separate connection to validate X.509 certificates, which allows "attacker-in-the-middle" attackers to trick a peer node with an arbitrary certificate. CVE-STATUS: default...

SQL Injection Vulnerability in Free Version of Keele Intermediary Guarantee System

KILO Intermediary Guarantee System is a TP5.1 based intermediary guarantee transaction system. The free version of KILO Intermediary Guarantee System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

CentOS 8 : haproxy (CESA-2020:1725)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:1725 advisory. - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked value CVE-2019-18277 - haproxy: HTTP/2...

Seal Finance Farm Security Breach

Seal Finance Farm is a network protocol used by the Seal Finance community to support decentralized trading.SEAL An experimental protocol that acts as an intermediary between the main DeFi protocol tokens, creating deeper liquidity between the two Seal Finance Farm has a security vulnerability. T...

EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1904)

According to the versions of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0x...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2020-1805)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1805)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa...

Command Execution Vulnerability in Free Version of Kilo Brokerage Guarantee System

Kile Intermediary is a TP5.1-based intermediary secured transactions system, Kile Intermediary secured transactions system is a professional virtual asset intermediary secured transactions system, the program can be used to do domain names, websites, accounts, small programs, WeChat public number...

File Upload Vulnerability in Free Version of Hefei Qile Network Technology Co.

KILO Intermediary Free Edition is a TP5.1 based intermediary secured trading system. Hefei Qile Network Technology Co., Ltd Qile Intermediary Guarantee System Free Edition has a file upload vulnerability that can be exploited by an attacker to gain control of the server...

haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...