PT-2021-1770 · Cisco +1 · Snort +1

Name of the Vulnerable Software and Affected Versions: Cisco products affected versions not specified Description: The issue is related to a vulnerability in the Snort detection engine, which could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. This is due ...

The Apache HTTP Server when accessed through a TCP connection with a large window size allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties who state that the large window size required by the attack is not normally supported or configured by the server or that a DDoS-style attack would accomplish the same goal

...

CVE-2020-15689

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service...

CVE-2020-15689

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service...

CVE-2020-15689

CVE-2020-15689 affects Appweb prior to 7.2.2 and 8.x prior to 8.1.0 when built with CGI support. A crafted HTTP Range header lacking an exact range can cause a NULL pointer dereference, leading to a denial of service. Impact is described as a crash/DoS without additional exploitation details in t...

PT-2020-14586 · Embedthis · Appweb

Name of the Vulnerable Software and Affected Versions: Appweb versions prior to 7.2.2 Appweb versions 8.x prior to 8.1.0 Description: The issue arises when Appweb, built with CGI support, fails to properly handle an HTTP request containing a Range header without an exact range. This mishandling c...

CVE-2020-15689: NULL Pointer Dereference

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service...

Security Bulletin: IBM Sterling B2B Integrator HTTP Range Header Vulnerability (CVE-2013-0494)

Summary IBM Sterling B2B Integrator is subject to HTTP Byte Range Denial Of Service attacks. Vulnerability Details CVE ID: CVE-2013-0494 DESCRIPTION: IBM Sterling B2B Integrator is subject to HTTP Byte Range Denial Of Service attacks. Specially crafted HTTP Range or Request-Range request headers...

Design/Logic Flaw

Dell EMC Open Manage System Administrator OMSA versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated attacker may send crafted requests with overlapping ranges to cause the application to compress each of the requested bytes, resulting in a...

CVE-2019-3721

Dell EMC Open Manage System Administrator OMSA versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated attacker may send crafted requests with overlapping ranges to cause the application to compress each of the requested bytes, resulting in a...

CVE-2019-3721 Improper Range Header Processing Vulnerability

Dell EMC Open Manage System Administrator OMSA versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated attacker may send crafted requests with overlapping ranges to cause the application to compress each of the requested bytes, resulting in a...

CVE-2019-3721

CVE-2019-3721 affects Dell EMC OpenManage System Administrator (OMSA) prior to version 9.3.0. The issue is an improper range header processing vulnerability in OMSA’s handling of HTTP Range requests; crafted requests with overlapping ranges can cause the application to compress each requested byt...

PT-2019-16666 · Dell Emc · Dell Emc Openmanage System Administrator

Name of the Vulnerable Software and Affected Versions: Dell EMC Open Manage System Administrator OMSA versions prior to 9.3.0 Description: The issue is related to improper range header processing. A remote unauthenticated attacker can send crafted requests with overlapping ranges, causing the...

CVE-2019-3721: Allocation of Resources Without Limits or Throttling

Dell EMC Open Manage System Administrator OMSA versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated attacker may send crafted requests with overlapping ranges to cause the application to compress each of the requested bytes, resulting in a...

Design/Logic Flaw

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substri...

CVE-2018-19791

LiteSpeed OpenLiteSpeed before 1.5.0 RC6 is affected. The server mishandles requests for byte sequences, allowing an attacker to amplify response size by repeatedly requesting the entire response body with an HTTP Range value starting with bytes=0-,0-. This can cause a Denial of Service (availabi...

CVE-2018-19791

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substri...

PT-2018-15093

Name of the Vulnerable Software and Affected Versions OpenLiteSpeed versions prior to 1.5.0 RC6 Description The issue arises from the server's incorrect handling of requests for byte sequences. An attacker can exploit this by amplifying the response size through repeated requests for the entire...

CVE-2018-19791: Improper Input Validation

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substri...

CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...