tomcat multiple content-length header poisioning

Jakarta Tomcat 5.0.19 Coyote/1.1 and Tomcat 4.1.24 Coyote/1.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat t...

tomcat multiple content-length header poisioning

Jakarta Tomcat 5.0.19 Coyote/1.1 and Tomcat 4.1.24 Coyote/1.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat t...

Cosign 2.0.1/2.9.4a - CGI Register Command Remote Authentication Bypass

source: https://www.securityfocus.com/bid/23424/info The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input. An authenticated attacker can exploit this issue to access services hosted on an affected computer by...

Fixed in Apache Tomcat 5.5.23, 5.0.SVN

Important: Information disclosure CVE-2005-2090 Requests with multiple content-length headers should be rejected as invalid. When multiple components firewalls, caches, proxies and Tomcat process a sequence of requests where one or more requests contain multiple content-length headers and several...

CVE-2007-1260

Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header...

Stack overflow

Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header...

CVE-2007-1260

Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header...

WebMod 0.48 (Content-Length) Remote Buffer Overflow Exploit PoC

No description provided by source. / WebMod Stack Buffer Overflow by cybermind Kevin Masterson [email protected] WebMod v0.48 exploit PoC code / include include include define WIN32LEANANDMEAN include include pragma comment lib, "ws232.lib" / local variables in connectHandle: char input; 4 char...

WebMod 0.48 - Content-Length Remote Buffer Overflow

WebMod 0.48 - Content-Length Remote Buffer Overflow / WebMod Stack Buffer Overflow by cybermind Kevin Masterson [email protected] WebMod v0.48 exploit PoC code / include include include define WIN32LEANANDMEAN include include pragma comment lib, "ws232.lib" / local variables in connectHandle:...

WebMod 0.48 (Content-Length) Remote Buffer Overflow Exploit PoC

Exploit for unknown platform in category remote exploits =============================================================== WebMod 0.48 Content-Length Remote Buffer Overflow Exploit PoC =============================================================== / WebMod Stack Buffer Overflow by cybermind Kevin...

MOAB-25-01-2007.rb.txt

!/usr/bin/ruby c Copyright 2007 Lance M. Havok Proof of concept for MOAB-25-01-2007. require 'socket' webport = ARGV0 || 80.toi puts "++ Starting HTTP server at port webport." webserver = TCPServer.newnil, webport while session = webserver.accept randclen = rand80 useragent =...

Apple CFNetwork - HTTP Response Denial of Service (Ruby)

Apple CFNetwork - HTTP Response Denial of Service Ruby !/usr/bin/ruby c Copyright 2007 Lance M. Havok Proof of concept for MOAB-25-01-2007. require 'socket' webport = ARGV0 || 80.toi puts "++ Starting HTTP server at port webport." webserver = TCPServer.newnil, webport while session =...

Apple CFNetwork - HTTP Response Denial of Service

!/usr/bin/ruby c Copyright 2007 Lance M. Havok Proof of concept for MOAB-25-01-2007. require 'socket' webport = ARGV0 || 80.toi puts "++ Starting HTTP server at port webport." webserver = TCPServer.newnil, webport while session = webserver.accept randclen = rand80 useragent =...

CVE-2007-0120

Acunetix Web Vulnerability Scanner WVS 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service application crash via multiple HTTP requests containing invalid Content-Length values...

CVE-2007-0120

Acunetix Web Vulnerability Scanner WVS 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service application crash via multiple HTTP requests containing invalid Content-Length values...

Acunetix WVS 4.0 20060717 - HTTP Sniffer Component Remote Denial of Service

Acunetix WVS 4.0 20060717 - HTTP Sniffer Component Remote Denial of Service !/usr/bin/perl -w Acunetix Web Vulnerability Scanner 4.0 = Build 20060717 HTTP Sniffer component Remote Denial of Service Explaination: I found a DoS in Acunetix WVS doing a little bit of fuzzing. The flaw is triggered wh...

In the benefits letter news system application file upload vulnerability-vulnerability warning-the black bar safety net

Recently everyone for dvbbs file upload vulnerability excited, thinking about other inside the system can not be used on? I will for the benefit of the letter of information systems to the topic! System environment: benefits letter press system 3. 1, Windows2000+sp4. Look at this line of code: |...

Technical note by Amit Klein: "Sending arbitrary HTTP requests with Flash 7/8 (+IE 6.0)"

Sending arbitrary HTTP requests with Flash 7/8 +IE 6.0 Amit Klein, August 2006 The trick ========= In 1, I showed how to forge parts of HTTP requests containing CRs and LFs using Flash. In that write-up, the data was part of the HTTP body section. However, combining the Content-Length overriding...

GLSA-200606-05 : Pound: HTTP request smuggling

The remote host is affected by the vulnerability described in GLSA-200606-05 Pound: HTTP request smuggling Pound fails to handle HTTP requests with conflicting 'Content-Length' and 'Transfer-Encoding' headers correctly. Impact : An attacker could exploit this vulnerability by sending HTTP request...

Ubuntu 5.04 / 5.10 : nagios vulnerability (USN-287-1)

The nagios CGI scripts did not sufficiently check the validity of the HTTP Content-Length attribute. By sending a specially crafted HTTP request with an invalidly large Content-Length value to the Nagios server, a remote attacker could exploit this to execute arbitrary code with web server...