64 matches found
PT-2022-24895 · Unknown · Parse Server
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.17 Parse Server versions prior to 5.2.8 on the 5.x branch Description: The issue occurs when a file download request is received with an invalid byte range, causing the server to crash and resulting in a...
CVE-2022-39958
The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be...
CVE-2022-39958 Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range
The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be...
CVE-2018-18689
The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected...
PT-2021-8830 · Wondershare +6 · Pdfelement6 Pro +10
Name of the Vulnerable Software and Affected Versions: Foxit Reader versions prior to 9.4 PhantomPDF versions prior to 8.3.9 and 9.x prior to 9.4 eXpert PDF 12 Ultimate affected versions not specified Expert PDF Reader affected versions not specified Nitro Pro affected versions not specified Nitr...
Using LL-HLS with byte-range addressing to achieve interoperability in low latency streaming
Introduction HTTP Adaptive Segmented HAS streaming began to be used at scale from 2008 to 2012, with the advent of Move Networks, Microsoft Smooth Streaming, Apple HLS, Adobe HDS, and MPEG DASH. With the typical 10s segment durations of the day, livestream latencies measuring latency as the time...
Using LL-HLS with Byte-Range Addressing to Achieve Interoperability in Low Latency Streaming
HTTP Adaptive Segmented HAS streaming began to be used at scale from 2008 to 2012, with the advent of Move Networks, Microsoft Smooth Streaming, Apple HLS, Adobe HDS, and MPEG DASH. With the typical 10s segment durations of the day, livestream latencies measuring latency as the time from an actio...
Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.0 security and bug fix update
An update for ceph is now available for Red Hat Ceph Storage 3.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
Nginx ngx_http_range_filter_module Integer Overflow (CVE-2017-7529)
An integer overflow vulnerability exists in Nginx. The vulnerability is due to insufficient validation of requested byte ranges...
CVE-2016-6407
Cisco AsyncOS through 9.5.0-444 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service link saturation by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219...
The vulnerability of the Squid HTTP Proxy Server software allows a malicious intruder to compromise the accessibility of protected information.
The vulnerability in HttpHdrRange.cc in Squid allows malicious actors to induce a service failure by sending requests containing specially crafted Range headers with unidentified byte-range values...
Ubuntu Update for apache2 USN-1259-1
Ubuntu Update for Linux kernel vulnerabilities USN-1259-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN12591.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for apache2 USN-1259-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This...
Fedora 15 : httpd-2.2.21-1.fc15 (2011-12715)
This update includes the latest stable release of the Apache HTTP Server, version 2.2.21. Two security issues have been fixed : modproxyajp when combined with modproxybalancer: Prevents unrecognized HTTP methods from marking ajp: balancer members in an error state, avoiding denial of service...
Killapache: DDOS tool - Half of the Internet is vulnerable now !
Killapache: DDOS tool - Half of the Internet is vulnerable now ! The Apache Software Foundation has announced a denial-of-service vulnerability that affects all versions of the ubiquitous Apache web server, leaving up to 65% of all websites vulnerable. A unknown flaw in the code for processing...
Killapache: DDOS tool - Half of the Internet is vulnerable now !
Killapache: DDOS tool - Half of the Internet is vulnerable now ! The Apache Software Foundation has announced a denial-of-service vulnerability that affects all versions of the ubiquitous Apache web server, leaving up to 65% of all websites vulnerable. A unknown flaw in the code for processing...
Apache Byte-Range Filter Denial of Service (CVE-2005-2728)
Apache HTTP Server is the most widely deployed web servers on the Internet. Apache HTTP server is capable of running on Microsoft Windows and wide variety of Unix-like platforms. The server may be run as a standalone web server, a proxy, or a reverse proxy. There exists a denial of service...
Ubuntu 4.10 / 5.04 : apache2, libapache-mod-ssl vulnerabilities (USN-177-1)
Apache did not honour the 'SSLVerifyClient require' directive within a block if the surrounding block contained a directive 'SSLVerifyClient optional'. This allowed clients to bypass client certificate validation on servers with the above configuration. CAN-2005-2700 Filip Sneppe discovered a...
Debian DSA-805-1 : apache2 - several vulnerabilities
Several problems have been discovered in Apache2, the next generation, scalable, extendable web server. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-1268 Marc Stern discovered an off-by-one error in the modssl Certificate Revocation List CRL...
[SECURITY] [DSA 805-1] New Apache2 packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 805-1 [email protected] http://www.debian.org/security/ Martin Schulze September 8th, 2005 http://www.debian.org/security/faq -...