1014 matches found
Ruby on Rails: ActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskService
ActiveStorage tries to force content-disposition: attachment for a list of content-types, including text/html. However, response-content-type and response-content-disposition in GCS and DiskService's URLs aren't signed, which means an attacker can modify them at will. This is not the case for Azu...
Content Module Denial of Service Vulnerability
The content module is a module for parsing HTTP connection headers. A security vulnerability exists in the content module. An attacker could exploit this vulnerability to cause a denial of service via malicious Content-Type and Content-Disposition headers...
CVE-2017-16111
The content module is a module to parse HTTP Content- headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header...
CVE-2017-16111
The content module is a module to parse HTTP Content- headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header...
Magento Downloadable Products Cross Site Scripting Vulnerability
Magento suffers from downloadable product information related cross site scripting vulnerabilities. Versions affected include Magento 2.0 prior to 2.0.18, Magento 2.1 prior to 2.1.12, and Magento 2.2 prior to 2.2.3. Advisory Title: Magento Stored Cross-Site Scripting a Downloadable Products...
GHSA-H77X-M5Q8-C29H Rack vulnerable to REDoS
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service infinite loop via a crafted Content-Disposion header...
Denial Of Service (DoS)
Apache cxf-core is vulnerable to denial of service DoS attacks. The attack can be triggered if the attacker sends a content-disposition value containing more than 50000 characters, leading to high CPU usage in the application...
The vulnerability of the Jakarta Multipart parser on the Apache Struts software platform allows a hacker to execute arbitrary code.
The vulnerability of the Jakarta Multipart parser on the Apache Struts software platform arises from insufficient checks of the values of Content-Type, Content-Disposition, and Content-Length headers. This allows attackers to execute commands on the target system...
Regular Expression Denial Of Service (ReDoS)
content is vulnerable to regular expression denial of service ReDoS attacks. Attackers can use malicious content-type or content-disposition headers to trigger the attack since it does not properly handle the OWS parametes in the headers...
WebFile Explorer 1.0 Arbitrary File Download
Exploit Title: WebFile Explorer 1.0 - Arbitrary File Download Dork: N/A Date: 09.08.2017 Vendor Homepage : http://speicher.host/ Software Link: https://codecanyon.net/item/webfile-explorer/20366192/ Demo: http://speicher.host/envato/codecanyon/demo/web-file-explorer/ Version: 1.0 Category: Webapp...
WebFile Explorer 1.0 - Arbitrary File Download
Exploit Title: WebFile Explorer 1.0 - Arbitrary File Download Dork: N/A Date: 09.08.2017 Vendor Homepage : http://speicher.host/ Software Link: https://codecanyon.net/item/webfile-explorer/20366192/ Demo: http://speicher.host/envato/codecanyon/demo/web-file-explorer/ Version: 1.0 Category: Webapp...
Apache Struts 2 Content-Disposition Remote Code Execution (CVE-2017-5638)
A remote code execution vulnerability exists in the Apache Struts2 using Jakarta multipart parser. An attacker could exploit this vulnerability by sending an invalid content-disposition as part of a file upload request. Successful exploitation could result in execution of arbitrary code on the...
Struts2 S2-046 vulnerability principles of analysis-vulnerability warning-the black bar safety net
Struts2 and blast a level of high-risk vulnerabilities---S2-046, a closer look, S2-046 and S2-045 vulnerability trigger points, the use of different ways. But also because the S2-046 and S2-045 trigger point is the same, so before through the upgrade or patch way to patch S2-045 vulnerability of...
S2-046: Struts 2 Remote Code Execution vulnerability（CVE-2017-5638）
It is possible to perform a RCE attack with a malicious Content-Disposition value or with improper Content-Length header. If the Content-Dispostion / Content-Length value is not valid an exception is thrown which is then used to display an error message to a user. This is a different vector for t...
Strust2 S2-046 remote code execution vulnerability two trigger point analysis-vulnerability warning-the black bar safety net
S2-046 vulnerability and S2-045 vulnerability is very similar, are by the error message into the buildErrorMessage this method caused. But this time there are two trigger points. Content-Length the length of value exceeds length Content-Disposition the filename there is an empty byte 0x01...
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...
Joomla DVFolderContent 1.0.2 Local File Disclosure
Exploit Title : Joomla DVFolderContent V1.0.2 Module - Local File Disclosure Exploit Author : Persian Hack Team Vendor Homepage : http://www.dvextensions.de/en/extensions/dvfoldercontent Category Webapps Tested on Win Version : V1.0.2 Date 2016/10/01 PoC The Vulnerable page is...
Instacart: Reflected File Download on recipe list search
Hi guys, Right now I'm searching for JSON issues on your API so I started to go deep into the XHR requests. When I noticed the following request:...
CVE-2016-5840
hotfixupload.cgi in Trend Micro Deep Discovery Inspector DDI 3.7, 3.8 SP1 3.81, and 3.8 SP2 3.82 allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header...