CVE-2021-43794

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous i.e. not logged in users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest...

CVE-2021-43794

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous i.e. not logged in users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest...

Denial of service

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous i.e. not logged in users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest...

CVE-2021-43794

CVE-2021-43794 affects Discourse. An attacker can poison the cache for anonymous users, causing a JSON blob to be shown instead of HTML and enabling a partial DoS. Some sources attribute this to cache-poisoning via the development-mode header. The vulnerability is mitigated in the latest stable, ...

CVE-2021-43794 Anonymous user cache poisoning via development-mode header in Discourse

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous i.e. not logged in users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A security vulnerability exists in Discourse, which could be exploited by attackers to poison the cache of anonymous i.e., not logged in users, resulting in a partial denial o...

PT-2021-23940 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse affected versions not specified Description: The issue affects Discourse, an open source discussion platform, where an attacker can poison the cache for anonymous users. This results in the users being shown a JSON blob instead of t...

node_exporter -- bypass security with cache poisoning

Prometheus team reports: Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back...

HTTP Request Smuggling

symfony/http-kernel is vulnerable to HTTP request smuggling. The vulnerability exists in handle function of SubRequestHandler due to missing extra trusted header in sub-request which allows an attacker to forge requests containing a X-Forwarded-Prefix HTTP header, leading to a web cache poisoning...

Webcache Poisoning in shopware/platform and shopware/core

Impact Webcache Poisoning via X-Forwarded-Prefix and sub-request Patches We recommend updating to the current version 6.4.6.1. You can get the update to 6.4.6.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For...

GHSA-R64M-QCHJ-HRJP Webcache Poisoning in shopware/platform and shopware/core

Impact Webcache Poisoning via X-Forwarded-Prefix and sub-request Patches We recommend updating to the current version 6.4.6.1. You can get the update to 6.4.6.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For...

Webcache Poisoning in symfony/http-kernel

Description ----------- When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the X-Forwarded- HTTP headers. HTTP headers that are not part of the "trustedheaders" allowed list are ignored and protect you from "Cache poisoning" attacks. In Symfo...

GHSA-Q3J3-W37X-HQ2Q Webcache Poisoning in symfony/http-kernel

Description ----------- When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the X-Forwarded- HTTP headers. HTTP headers that are not part of the "trustedheaders" allowed list are ignored and protect you from "Cache poisoning" attacks. In Symfo...

CVE-2021-41267

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...

CVE-2021-41267

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...

CVE-2021-41267

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...

Design/Logic Flaw

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...

UBUNTU-CVE-2021-41267

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...

CVE-2021-41267

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...

CVE-2021-41267 Webcache Poisoning in Symfony

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trustedheaders" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2,...