Design/Logic Flaw

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

UBUNTU-CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

CVE-2022-39957 Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

CVE-2022-39957

CVE-2022-39957 affects the OWASP ModSecurity Core Rule Set (CRS). The issue is a response body bypass: a client can send an HTTP Accept header with an optional charset parameter, causing the WAF to deliver a form that may not be decoded correctly, potentially bypassing detection of restricted res...

CVE-2022-39957: Protection Mechanism Failure

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

PT-2022-25144 · Owasp +1 · Owasp Modsecurity Core Rule Set +1

Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions 3.0.x through 3.3.2 Description: The issue concerns a response body bypass in the OWASP ModSecurity Core Rule Set CRS. A client can exploit this by issuing an HTTP Accept header field with an...

CVE-2022-39957 Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

Front-running of accept call

Lines of code Vulnerability details Description There is accept and veto functions in the PartyGovernance contract. The functions accepts the proposalId accept function also accepts snapIndex, which does not contain any information about the proposal itself. As a result, transactions of users can...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

Slack: Bypass invite accept for victim

Vulnerability description not provided...

Reddit: Reddit talk promotion offers don't expire, allowing users to accept them after being demoted

Description: When promoting a user to a speaker/host, an offerId is created which can be accepted by the user. However, after accepting them the offerIds don't expire. This means that after the user is demoted back to a listener, they can still use the offerIds to go back to their previous promot...

PT-2022-32617

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.58 Description A data-race issue exists around sysctl tcp fwmark accept. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v3.16 and is fixed in Linux...

PT-2022-32396

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.15 Description A data-race issue exists around sysctl tcp fwmark accept. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v3.16 and is fixed in Linux...

PT-2022-33044

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.254 Description A data-race issue exists around sysctl tcp fwmark accept. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.19.254,...

PT-2022-32371

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.15 Description A data-race issue exists around sysctl udp l3mdev accept. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.18.15, upda...

PT-2022-32783

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.134 Description A data-race issue exists around sysctl udp l3mdev accept. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.10.134,...

PT-2022-33171

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.325 Description A data-race issue exists around sysctl tcp fwmark accept. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.9.325, upda...