CVE-2011-2668

Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header...

HTTP Request Smuggling

waitress is vulnerable HTTP request smuggling. The vulnerability exists because the library mishandled HTTP request header by not correctly parsing special whitespace characters in the Transfer-Encoding header, causing the parser to use Content-Length header instead to determine the HTTP message...

Design/Logic Flaw

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with t...

ceph: denial of service in RGW daemon

A flaw was found in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server...

ceph: denial of service in RGW daemon

A flaw was found in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server...

Red Hat Ceph Storage Denial of Service Vulnerability (CNVD-2020-01642)

Red Hat Ceph Storage is a scalable, open software-defined storage platform from Red Hat. A denial of service vulnerability exists in Red Hat Ceph Storage version 3, which can be exploited to cause a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RAD...

CVE-2009-5047

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-4611. Reason: This candidate is a duplicate of CVE-2009-4611. Notes: All CVE users should reference CVE-2009-4611 rather than this candidate. All references and descriptions in this candidate have been removed to prevent...

PT-2019-6517 · Eclipse · Jetty

Name of the Vulnerable Software and Affected Versions: Jetty versions 6.x through 6.1.21 Description: The issue concerns an escape sequence injection vulnerability that can be exploited through two vectors: the "Cookie Dump Servlet" and the HTTP Content-Length header. Specifically, a POST request...

Null pointer dereference

Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...

CVE-2019-17502

CVE-2019-17502 affects Hydra up to version 0.1.8 and involves a NULL pointer dereference that can crash the daemon when processing POST requests without a Content-Length header. The issue is tied to read.c, request.c, and util.c, with the process_header_end() function calling boa_atoi(), which ul...

CVE-2019-17502

Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...

UBUNTU-CVE-2014-10375

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

CVE-2014-10375

CVE-2014-10375 concerns eXosip’s handling of TLS messages in the eXtl_tls.c module (pre-5.0.0) where a negative value in a Content-Length header is mishandled. The vulnerability originates from the content-length parsing logic in handle_messages, enabling malformed TLS headers to affect eXosip pr...

Moderate: Red Hat Security Advisory: http-parser security update

An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

如何针对使用HTTP的.NET Remoting finding and using deserialization vulnerability-vulnerability warning-the black bar safety net

One, overview In the NCC Group and most recent safety assessment, 我发现了一个.NET v2. 0 app, 该应用程序使用.NET Remoting by HTTP to send the SOAP request to the other server to communicate. In the application of the anti-compiled, I realized that the server has TypeFilterLevel is set to Full, this is very...

UBUNTU-CVE-2019-7733

In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove...

Request-smuggling Attacks

Apache Tomcat Coyote before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, doesn't handle inconsistent HTTP request headers well when an HTTP or AJP connector is used. This allows remote attackers to incorrectly identify the requests length and conduct request-smuggling attacks through...

Denial Of Service (DoS)

Jetty HTTP Server is vulnerable to denial of service. HTTP requests are not properly validated, which allows for a remote attacker to cause the application to crash via a large value in the Content-Length header...

Foscam Opticam i5 Denial of Service Vulnerability (CNVD-2018-22817)

Foscam Opticam i5 is an IP camera from FOSCAM. A denial of service vulnerability exists in RtspServer in the Foscam Opticam i5 with system firmware 1.5.2.11 and application firmware 2.21.1.128. A remote attacker can exploit this vulnerability to cause a denial of service daemon hang or restart vi...

CVE-2018-19077

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. RtspServer allows remote attackers to cause a denial of service daemon hang or restart via a negative integer in the RTSP Content-Length header...