CVE-2018-7159

It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior...

CVE-2019-17502

Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...

Null pointer dereference

Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...

CVE-2019-17502

CVE-2019-17502 affects Hydra up to version 0.1.8 and involves a NULL pointer dereference that can crash the daemon when processing POST requests without a Content-Length header. The issue is tied to read.c, request.c, and util.c, with the process_header_end() function calling boa_atoi(), which ul...

CVE-2019-17502

Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...

CVE-2009-0840

Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header...

F5 Networks BIG-IP : Node.js vulnerability (K27228191)

The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been...

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 lies in a buffer overflow issue during the processing of input data using the Content-Length header. Exploiting this vulnerability allows an attacker to...

Scientific Linux Security Update : http-parser on SL7.x x86_64 (20190806)

Security Fixes : - nodejs: Denial of Service with large HTTP headers CVE-2018-12121 - nodejs: HTTP parser allowed for spaces inside Content-Length header values CVE-2018-7159 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description...

CVE-2014-10375

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

Design/Logic Flaw

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

CVE-2014-10375

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

UBUNTU-CVE-2014-10375

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

CVE-2014-10375

CVE-2014-10375 concerns eXosip’s handling of TLS messages in the eXtl_tls.c module (pre-5.0.0) where a negative value in a Content-Length header is mishandled. The vulnerability originates from the content-length parsing logic in handle_messages, enabling malformed TLS headers to affect eXosip pr...

CVE-2014-10375

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

CVE-2014-10375

Removed by vendor...

Moderate: Red Hat Security Advisory: http-parser security update

An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

nodejs: HTTP parser allowed for spaces inside Content-Length header values

It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior...

GrandNode 4.40 Path Traversal / File Download

Exploit Title: GrandNode Path Traversal & Arbitrary File Download Unauthenticated Date: 06/23/3019 Exploit Author: Corey Robinson https://twitter.com/CRobSec Vendor Homepage: https://grandnode.com/ Software Link:...

BlogEngine.NET 3.3.63.3.7 - theme Cookie Directory Traversal Remote Code Execution

BlogEngine.NET 3.3.63.3.7 - theme Cookie Directory Traversal Remote Code Execution Exploit Title: Directory Traversal + RCE on BlogEngine.NET Date: 17 Jun 2019 Exploit Author: Aaron Bishop Vendor Homepage: https://blogengine.io/ Version: v3.3.7 Tested on: 3.3.7, 3.3.6 CVE : 2019-10720 1...