9438 matches found
Code injection
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
CVE-2019-18277
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
UBUNTU-CVE-2019-18277
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
CVE-2019-18277
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
CVE-2019-18277
CVE-2019-18277 affects HAProxy in legacy mode: requests with a transfer-encoding header missing the chunked value are not properly rejected, which combined with http-reuse always can aid HTTP request smuggling against a vulnerable component with a lenient parser that ignores content-length after ...
CVE-2019-18277
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request...
X (Formerly Twitter): http request smuggling in twitter.com
Summary: the same vulnerability reported in other domain , see this report here Description: the Description of HTTP request smuggling attacks : here Detect HTTP request smuggling attack subdomains vulnerable: -to detect HTTP request smuggling attack with add header Transfer-Encoding: chunked and...
X (Formerly Twitter): http request smuggling in pscp.tv and periscope.tv
Description: the Description of HTTP request smuggling attacks : here seems that many subdomains in pscp.tv and periscope.tv vulenrable 1-Detect HTTP request smuggling attack 504 response with delay 30 s, 60s "DoS" POC & Steps To Reproduce: in this video F606648 Resource:...
GHSA-P979-4MFW-53VG HTTP Request Smuggling in Netty
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...
HTTP Request Smuggling in Netty
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...
Razer: Request Smuggling vulnerability due a vulnerable skipper reverse proxy running in the environment.
The tester discovered that a server was using Skipper as a reverse proxy that was not fully patched, allowing a request smuggling vulnerability. We thank the tester for his report and excellent PoC and his patience with the slow response of the engineering team...
CVE-2019-16869
A flaw was found in Netty, where whitespace before the colon in HTTP headers is mishandled. This flaw allows an attacker to cause HTTP request smuggling. Mitigation Use HTTP/2 instead clear boundaries between requests Disable reuse of backend connections eg. http-reuse never in HAProxy or whateve...
Debian: Security Advisory (DLA-1941-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DLA-1941-1 : netty security update
Netty mishandled whitespace before the colon in HTTP headers such as a 'Transfer-Encoding : chunked' line, which lead to HTTP request smuggling. For Debian 8 'Jessie', this problem has been fixed in version 1:3.2.6.Final-2+deb8u1. We recommend that you upgrade your netty packages. NOTE: Tenable...
[SECURITY] [DLA 1941-1] netty security update
Package : netty Version : 1:3.2.6.Final-2+deb8u1 CVE ID : CVE-2019-16869 Netty mishandled whitespace before the colon in HTTP headers such as a “Transfer-Encoding : chunked” line, which lead to HTTP request smuggling. For Debian 8 "Jessie", this problem has been fixed in version...
CVE-2019-16276
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling...
CVE-2019-16276
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling...
Design/Logic Flaw
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling...