2513 matches found
CVE-2014-10375
CVE-2014-10375 concerns eXosip’s handling of TLS messages in the eXtl_tls.c module (pre-5.0.0) where a negative value in a Content-Length header is mishandled. The vulnerability originates from the content-length parsing logic in handle_messages, enabling malformed TLS headers to affect eXosip pr...
CVE-2014-10375
Removed by vendor...
nodejs: HTTP parser allowed for spaces inside Content-Length header values
It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior...
Moderate: Red Hat Security Advisory: http-parser security update
An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
GrandNode 4.40 Path Traversal / File Download
Exploit Title: GrandNode Path Traversal & Arbitrary File Download Unauthenticated Date: 06/23/3019 Exploit Author: Corey Robinson https://twitter.com/CRobSec Vendor Homepage: https://grandnode.com/ Software Link:...
BlogEngine.NET 3.3.63.3.7 - theme Cookie Directory Traversal Remote Code Execution
BlogEngine.NET 3.3.63.3.7 - theme Cookie Directory Traversal Remote Code Execution Exploit Title: Directory Traversal + RCE on BlogEngine.NET Date: 17 Jun 2019 Exploit Author: Aaron Bishop Vendor Homepage: https://blogengine.io/ Version: v3.3.7 Tested on: 3.3.7, 3.3.6 CVE : 2019-10720 1...
GHSA-42XW-2XVC-QX8M Denial of Service in axios
Versions of axios prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the maxContentLength property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service. Recommendation Upgrade to 0.18.1 or later...
DEBIAN-CVE-2019-10742
Axios up to and including 0.18.0 allows attackers to cause a denial of service application crash by continuing to accepting content after maxContentLength is exceeded...
UBUNTU-CVE-2019-10742
Axios up to and including 0.18.0 allows attackers to cause a denial of service application crash by continuing to accepting content after maxContentLength is exceeded...
CVE-2019-10742
Axios up to and including 0.18.0 allows attackers to cause a denial of service application crash by continuing to accepting content after maxContentLength is exceeded...
如何针对使用HTTP的.NET Remoting finding and using deserialization vulnerability-vulnerability warning-the black bar safety net
One, overview In the NCC Group and most recent safety assessment, 我发现了一个.NET v2. 0 app, 该应用程序使用.NET Remoting by HTTP to send the SOAP request to the other server to communicate. In the application of the anti-compiled, I realized that the server has TypeFilterLevel is set to Full, this is very...
py-twisted -- multiple vulnerabilities
Twisted developers reports: All HTTP clients in twisted.web.client now raise a ValueError when called with a method and/or URL that contain invalid characters. This mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this vulnerability. The HTTP/2 server implementation now enforces T...
New Relic: Password theft login.newrelic.com via Request Smuggling
Hi, The Rails application at login.newrelic.com is accessed through a proxy written in Golang, and an nginx server. By sending an ambiguous request, an attacker can desynchronize these servers, leaving the socket to the backend poisoned with a harmful response. This response will then be served u...
LIVE555 Buffer Overflow Vulnerability
LIVE555 is a set of open source C++ libraries for multimedia streaming. Live555 suffers from a buffer overflow vulnerability. The vulnerability stems from handleRequestBytes having an unrestricted memmove, which can be exploited to cause a denial of service via a large integer in the Content-Leng...
CVE-2019-7733
In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove...
CVE-2019-7733
In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove...
UBUNTU-CVE-2019-7733
In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove...
CVE-2019-7733
Removed by vendor...
CVE-2019-7733
In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove...
Request-smuggling Attacks
Apache Tomcat Coyote before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, doesn't handle inconsistent HTTP request headers well when an HTTP or AJP connector is used. This allows remote attackers to incorrectly identify the requests length and conduct request-smuggling attacks through...