44 matches found
SUSE CVE-2024-42330
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...
ws server.maxHeadersCount DoS
The vulnerability of the server.maxHeadersCount configuration in the client-server library ws of the Node.js software platform is related to errors in pointer assignment due to exceeding the threshold values of request headers. Exploiting this vulnerability may allow a remote attacker to trigger ...
CVE-2024-41907
A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V2.0. The affected application is missing general HTTP security headers in the web server. This could allow an attacker to make the servers more prone to clickjacking attack...
Royal Elementor Addons < 1.3.95 - Unauthenticated IP Spoofing
Description The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to IP Address Spoofing due to insufficient IP address validation. This makes it possible for unauthenticated attackers to spoof their IP addresses. PoC Set any of the following server headers as used in...
curl: out of heap memory issue due to missing limit on header quantity
A flaw was found in the Curl package. Curl allows a malicious server to stream an endless series of headers to a client due to missing limit on header quantity, eventually causing curl to run out of heap memory, which may lead to a crash...
UBUNTU-CVE-2023-38039
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...
SolarWinds Security Event Manager information leakage vulnerability
SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. An information disclosure vulnerability exists in SolarWinds Security Event Manager versions prior to 2022.4, which stems from the...
CVE-2021-20585
IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398...
Information disclosure
IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398...
IBM Security Verify Access information leakage vulnerability
IBM Security Verify Access, formerly known as IBM Security Access Manager or ISAM, is designed to help you simplify user access and more securely adopt Web, mobile, IoT and cloud technologies. An information disclosure vulnerability exists in IBM Security Verify Access version 20.07. An attacker...
CVE-2021-20585
IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398...
CVE-2021-20585
CVE-2021-20585 affects IBM Security Verify Access 20.07. It allows disclosure of sensitive information via HTTP server headers (partial confidentiality impact). No explicit root cause or remediation details are provided in the connected documents; exploitation status not described. Monitor for up...
CVE-2021-20585: Exposure of Sensitive Information to an Unauthorized Actor
IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398...
PT-2021-14058
Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access version 20.07 Description: The issue could disclose sensitive information in HTTP server headers, potentially leading to further attacks against the system. Recommendations: For IBM Security Verify Access version...
CVE-2021-20585
IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398...
ruby: HTTP response splitting in WEBrick
It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...
ruby: HTTP response splitting in WEBrick
It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...
Node.js: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests
Summary: Node.js is vulnerable to HTTP denial of service DOS attacks based on delayed requests submission which can make the server unable to accept new connections. Description: An attacker can open an arbitrary number of HTTP connections and keep the server busy by never completing the request...
EyeWitness - Tool To Take Screenshots Of Websites, Provide Some Server Header Info, And Identify Default Credentials If Possible
EyeWitness is designed to take screenshots of websites provide some server header info, and identify default credentials if known. EyeWitness is designed to run on Kali Linux. It will auto detect the file you give it with the -f flag as either being a text file with URLs on each new line, nmap xm...
ruby: HTTP response splitting in WEBrick
It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...