CVE-2018-12121

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers almost 80 KB per connection, and carefully timed completion of the headers, it is possible to cause the HTTP...

CVE-2018-12121

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers almost 80 KB per connection, and carefully timed completion of the headers, it is possible to cause the HTTP...

HackerOne: Corrupted Authorization header can cause logs not to be ingested properly in ████████

HackerOne ingests different logs in ██████, one of them being nginx access logs from our load balancers. The default log format of our load balancer configuration is shown below. As can be seen in the format, the HTTP user specified in the Authorization header $remoteuser is placed between the...

HTTPS client certificate authentication security issues. Part 1/3

Sometimes we need to improve web authentication by client certificates. It’s much better than passwords, allows to enable 2nd factor because of hardware keys and just sounds so strong, isn’t it? ; Let’s look inside it to understand how secure is it and what to check to be sure, that you didn’t...

September 20, 2018—KB4457139 (Preview of Monthly Rollup)

None None...

Error : "An error occurred while building your environment...". Synchronization State of WEM Agents Has a Red "X"

After upgrading WEM from 4.2 to 4.4, WEM agents are failing to connect to the WEM server with the following error: "An error occurred while building your environment. Agent processing will now stop. Please contact your Administrator." Issue only occurs when connections are going through Load...

CVE-2018-3925

An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely parses the AWSELB cookie while communicating with remote video-hos...

NetScaler MAS Not Showing SSL Insight Data

Any SSL load balancer, content switching or NetScaler Gateway does not display SSL Insight data...

Barracuda ADC 5.x Cross Site Scripting

Document Title: =============== Barracuda ADC v5.x - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1424 Release Date: ============= 2018-07-12 Vulnerability Laboratory ID VL-ID: ====================================...

Barracuda ADC 5.x - Multiple Persistent Vulnerabilities

Document Title: =============== Barracuda ADC 5.x - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1424 Release Date: ============= 2018-07-11 Vulnerability Laboratory ID VL-ID: ==================================== 14...

Barracuda ADC 5.x - Filter Bypass & Persistent Vulnerability

Document Title: =============== Barracuda ADC 5.x - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1423 Release Date: ============= 2018-07-09 Vulnerability Laboratory ID VL-ID: ==================================...

Barracuda ADC 5.x - Filter Bypass & Persistent Vulnerability

Document Title: =============== Barracuda ADC 5.x - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1423 Release Date: ============= 2018-07-08 Vulnerability Laboratory ID VL-ID: ==================================...

Security Bulletin: Some versions of IBM Security Access Manager for Web are affected by the Heartbleed vulnerability (CVE-2014-0160)

Summary IBM Security Access Manager ISAM for Web v8.0 introduced a layer 7 front end load balancer. The SSL framework used by this component exposes the 'heartbeat' TLS extension implemented through an affected version of OpenSSL and is therefore susceptible to the Heartbleed vulnerability...

CVE-2012-10039

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zenloadbalancerexec.rb 2025-10-23 21:12:56+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

PCI Scan Accuracy cannot be verified through Load Balancer with non-identically configured or non-synced systems

The remote has is behind a load balancer either with a non-identical configurations to its peers, or is not synced with its peers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109582; scriptversion"1.2"; scriptcvsdate"Date: 2019/04/04 10:19:47";...

QID 86725 “F5 BIG-IP Load Balancer Internal IP Address Disclosure”

QID 86725 “F5 BIG-IP Load Balancer Internal IP Address Disclosure Vulnerability” will be marked as a PCI Fail as of May 1, 2018 in accordance with its CVSS score. F5 BIG IP encodes private IP addresses in the persistent cookies, which could be collected by the attacker and decoded back. The...

CVE-2016-8612

Apache HTTP Server modcluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process...

CVE-2017-15524

The Application Firewall Pack AFP, aka Web Application Firewall component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request...

CVE-2017-15524

The Application Firewall Pack AFP, aka Web Application Firewall component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request...

Security feature bypass

The Application Firewall Pack AFP, aka Web Application Firewall component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request...