Vulnerability fixed in SonicOS

SonicWall has fixed a vulnerability in SonicOS. A malicious party could potentially exploit the vulnerability to send a user on the vulnerable SonicWall system via a header redirection to a rogue website under the control of the malicious party's control. However, the rogue website and the...

Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling

Impact Prior to puma version 5.5.0, using puma with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. This behavior forwarding LF character...

GHSA-48W2-RM65-62XX Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling

Impact Prior to puma version 5.5.0, using puma with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. This behavior forwarding LF character...

HTTP Request Smuggling

Overview puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process...

DEBIAN-CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

UBUNTU-CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

PT-2021-8119 · Apache +5 · Apache Traffic Server +6

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 5.5.1 and 4.3.9 Description: The issue is related to HTTP request smuggling when using Puma with a proxy that forwards HTTP header values containing the LF character. This could allow a client to smuggle a request throu...

FreeBSD : go -- misc/wasm, cmd/link: do not let command line arguments overwrite global data (4fce9635-28c0-11ec-9ba8-002324b2fba8)

The Go project reports : When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments. If using wasmexec.js to execute WASM modules, users will need to replace their copy...

Aruba Instant Path Traversal Vulnerability

Aruba Instant is a wireless network. Aruba Instant provides the only Wi-Fi solution that is easy to set up.A path traversal vulnerability exists in Aruba Instant, which stems from an input validation error when processing directory traversal sequences in the on-the-fly command line interface. An...

CVE-2021-33903

In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. However, changing the password of the root user via LANconfig does change the password of the root user for...

SpoolSploit - A Collection Of Windows Print Spooler Exploits Containerized With Other Utilities For Practical Exploitation

A collection of Windows print spooler exploits containerized with other utilities for practical exploitation. Summary SpoolSploit is a collection of Windows print spooler exploits containerized with other utilities for practical exploitation. A couple of highly effective methods would be relaying...

Lancom Lcos 安全漏洞

Lancom Lcos is a Lancom operating system built for Lancom routers, wireless by Lancom Greece. versions 10.40 to 10.42.0473-RU3 of LCOS contain a security vulnerability that could be exploited by an attacker to change the root user password via the CLI...

Aruba Instant 格式化字符串错误漏洞

Aruba Instant is a wireless network from Aruba USA. provides the only Wi-Fi solution that is easy to set up. Aruba Instant suffers from a Formatting String Error vulnerability that originates from a formatting string error in the Instant Command Line Interface. The vulnerability allows remote use...

Aruba Instant 操作系统命令注入漏洞

Aruba Instant is a wireless network. Providing the only Wi-Fi solution that is easy to set up, Aruba Instant is vulnerable to a command injection vulnerability that stems from incorrect input validation in the command line interface. An attacker could exploit the vulnerability to escalate...

Aruba Instant 操作系统命令注入漏洞

Aruba Instant is a wireless network from Aruba, Inc. provides the only Wi-Fi solution that is easy to set up.Aruba Instant is vulnerable to an operating system command injection vulnerability that stems from incorrect input validation in the command line interface. A remote authenticated attacker...

go -- misc/wasm, cmd/link: do not let command line arguments overwrite global data

The Go project reports: When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments. If using wasmexec.js to execute WASM modules, users will need to replace their copy aft...

CVE-2021-31988

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed CRLF control characters and include arbitrary SMTP headers in the generated test email...

PT-2021-19617 · Axis Communications +1 · Axis Os +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a user-controlled parameter in the SMTP test functionality that is not correctly validated. This allows an attacker to add...

Axis Os 注入漏洞

Axis Os is an edge device operating system from Axis of Sweden. An injection vulnerability exists in Axis devices AXIS OS version 5.51 and later versions, which stems from a failure to properly validate a control parameter related to the SMTP test function, and as a result, it is possible to add...