ALPINE-CVE-2021-33620

Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service affecting availability to all clients via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server...

CVE-2021-23853

In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs...

CVE-2021-26562

Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via synofindersite HTTP header...

The vulnerability of the Twisted Web network framework’s component, allowing a hacker to cause a service failure

The vulnerability of the Twisted Web network framework’s component involves insufficient validation of input data during the processing of HTTP headers. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the microprogramming software for Schneider Electric Modicon Quantum and Schneider Electric Modicon M340 allows a hacker to obtain information about the SMTP server configuration, including user logins and passwords.

The vulnerability of the microprogramming software in Schneider Electric Modicon Quantum and Schneider Electric Modicon M340 controllers is related to security mechanism failures. Exploiting this vulnerability can allow attackers to obtain information about the SMTP server configuration, includin...

The vulnerability of the syntax analysis function for HTTP headers of TP-Link TL-R600VPN software routers allows a hacker to execute arbitrary code.

The vulnerability of the syntax analysis function for HTTP headers of TP-Link TL-R600VPN software lies in the fact that the operation is performed outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted HTTP...

The vulnerability of the WEBrick library for the Ruby programming language allows attackers to inject arbitrary HTTP headers.

The vulnerability of the WEBrick library for the Ruby programming language interpreter is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers remotely...

CVE-2017-11580

Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless connection provided by the device, if a large string is sent as a part of the HTTP request in any part of the HTTP headers, the device coul...

GHSA-QX2F-477C-35RQ method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header. Recommendation Update to version 2.3.10 or later...

CVE-2018-7680

Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values...

DEBIAN-CVE-2017-10868

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

The vulnerability of the URLConnection class in the Android operating system allows a hacker to inject arbitrary scripts or set arbitrary values in cookies.

The vulnerability of the HTTP header of the URLConnection class in the Android operating system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary scripts or set arbitrary values in cookies remotely...

DEBIAN-CVE-2006-3124

Buffer overflow in the HTTP header parsing in Streamripper before 1.61.26 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted HTTP headers...

DEBIAN-CVE-2002-1405

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters...