K13114: Apache Range header vulnerability - CVE-2011-3192

Security Advisory Description The byte-range filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial-of-service memory and CPU consumption using aRange header that expresses multiple overlapping ranges. When this vulnerabili...

Denial Of Service (DoS)

parse-server is vulnerable to denial of service. The vulnerability exists in multiple functions due to user inputs not properly validated which allows an attacker to send a file download request with an invalid byte range causing an application crash...

Parse Server 输入验证错误漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An input validation error vulnerability exists in Parse Server prior to version 4.10.17 and version 5.x prior to version 5.2.8, which stems from a crash upon receiving a file download request...

GHSA-H423-W6QV-2WJ3 parse-server crashes when receiving file download request with invalid byte range

Impact Parse Server crashes when a file download request is received with an invalid byte range. Patches Improved parsing of the range parameter to properly handle invalid range requests. Workarounds None References - GHSA-h423-w6qv-2wj3...

parse-server crashes when receiving file download request with invalid byte range

Impact Parse Server crashes when a file download request is received with an invalid byte range. Patches Improved parsing of the range parameter to properly handle invalid range requests. Workarounds None References - GHSA-h423-w6qv-2wj3...

PT-2022-24895 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.17 Parse Server versions prior to 5.2.8 on the 5.x branch Description: The issue occurs when a file download request is received with an invalid byte range, causing the server to crash and resulting in a...

CVE-2022-39958

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be...

CVE-2022-39958 Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be...

CVE-2018-18689

The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected...

PT-2021-8830 · Wondershare +6 · Pdfelement6 Pro +10

Name of the Vulnerable Software and Affected Versions: Foxit Reader versions prior to 9.4 PhantomPDF versions prior to 8.3.9 and 9.x prior to 9.4 eXpert PDF 12 Ultimate affected versions not specified Expert PDF Reader affected versions not specified Nitro Pro affected versions not specified Nitr...

Using LL-HLS with byte-range addressing to achieve interoperability in low latency streaming

Introduction HTTP Adaptive Segmented HAS streaming began to be used at scale from 2008 to 2012, with the advent of Move Networks, Microsoft Smooth Streaming, Apple HLS, Adobe HDS, and MPEG DASH. With the typical 10s segment durations of the day, livestream latencies measuring latency as the time...

Using LL-HLS with Byte-Range Addressing to Achieve Interoperability in Low Latency Streaming

HTTP Adaptive Segmented HAS streaming began to be used at scale from 2008 to 2012, with the advent of Move Networks, Microsoft Smooth Streaming, Apple HLS, Adobe HDS, and MPEG DASH. With the typical 10s segment durations of the day, livestream latencies measuring latency as the time from an actio...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.0 security and bug fix update

An update for ceph is now available for Red Hat Ceph Storage 3.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Nginx ngx_http_range_filter_module Integer Overflow (CVE-2017-7529)

An integer overflow vulnerability exists in Nginx. The vulnerability is due to insufficient validation of requested byte ranges...

CVE-2016-6407

Cisco AsyncOS through 9.5.0-444 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service link saturation by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219...

The vulnerability of the Squid HTTP Proxy Server software allows a malicious intruder to compromise the accessibility of protected information.

The vulnerability in HttpHdrRange.cc in Squid allows malicious actors to induce a service failure by sending requests containing specially crafted Range headers with unidentified byte-range values...

Ubuntu Update for apache2 USN-1259-1

Ubuntu Update for Linux kernel vulnerabilities USN-1259-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN12591.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for apache2 USN-1259-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This...

Fedora 15 : httpd-2.2.21-1.fc15 (2011-12715)

This update includes the latest stable release of the Apache HTTP Server, version 2.2.21. Two security issues have been fixed : modproxyajp when combined with modproxybalancer: Prevents unrecognized HTTP methods from marking ajp: balancer members in an error state, avoiding denial of service...

Killapache: DDOS tool - Half of the Internet is vulnerable now !

Killapache: DDOS tool - Half of the Internet is vulnerable now ! The Apache Software Foundation has announced a denial-of-service vulnerability that affects all versions of the ubiquitous Apache web server, leaving up to 65% of all websites vulnerable. A unknown flaw in the code for processing...

Killapache: DDOS tool - Half of the Internet is vulnerable now !

Killapache: DDOS tool - Half of the Internet is vulnerable now ! The Apache Software Foundation has announced a denial-of-service vulnerability that affects all versions of the ubiquitous Apache web server, leaving up to 65% of all websites vulnerable. A unknown flaw in the code for processing...