132 matches found
EulerOS Virtualization 3.0.2.2 : httpd (EulerOS-SA-2023-1260)
According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in modauthdigest. There is...
Fedora 36 : mingw-python3 (2022-d1682fef04)
The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d1682fef04 advisory. Update to python-3.10.8. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
SUSE-SU-2022:3940-1 Security update for python
This update for python fixes the following issues: - CVE-2021-28861: Fixed an open redirection vulnerability in the HTTP server when an URI path starts with // BaseHTTPServer bsc1202624...
SUSE-SU-2022:3512-1 Security update for python
This update for python fixes the following issues: - CVE-2021-28861: Fixed an open redirection vulnerability in the HTTP server when an URI path starts with // bsc1202624...
OESA-2022-1879 python3 security update
Python combines remarkable power with very clear syntax. It has modules,classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C+...
CVE-2021-28861
A vulnerability was found in python. This security flaw causes an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of the URI path. This issue may lead to information disclosure...
CVE-2021-28861
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...
AZL-10618 CVE-2021-28861 affecting package python3 for versions less than 3.9.19-1
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...
CVE-2021-28861
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...
CVE-2021-28861
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...
curl: error parse uri path in curl
Summary: add summary of the vulnerability The uri path error could lead to security filter bypasses. For example, we can use curl -vv 'fh-jle:///etc/passwd' to bypass file protocol black list we can use curl -vv 'http://1.1.1.1:80-9000' to scan the open port in the host etc ... Steps To Reproduce...
Grafana Cross-site Scripting (CVE-2021-41174)
A cross-site scripting vulnerability exists in Grafana. The vulnerability is due to insufficient validation of user input in the URI path...
The vulnerability of the mod_proxy_uwsgi function in the Apache HTTP Server allows a hacker to cause a service failure.
The vulnerability of the modproxyuwsgi function in the Apache HTTP Server is related to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow a malicious actor to cause a service failure for an application through a uri-path request...
CVE-2021-22053
Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...
CVE-2021-22053
Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...
httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"
A Server-Side Request Forgery SSRF flaw was found in modproxy of httpd. This flaw allows a remote, unauthenticated attacker to make the httpd server forward requests to an arbitrary server. The attacker could get, modify, or delete resources on other services that may be behind a firewall and...
SUSE-SU-2021:3335-1 Security update for apache2
This update for apache2 fixes the following issues: - CVE-2021-40438: Fixed a SRF via a crafted request uri-path. bsc1190703 - CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. bsc1190702 - CVE-2021-39275: Fixed an out-of-bounds write in apescapequotes via malicious inpu...
PT-2021-23077 · Http4S · Http4S
Name of the Vulnerable Software and Affected Versions: http4s versions prior to 0.21.30 http4s versions prior to 0.22.5 http4s versions prior to 0.23.4 http4s versions prior to 1.0.0-M27 Description: http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input...
AZL-6487 CVE-2021-40438 affecting package httpd for versions less than 2.4.52-1
A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier...