CVE-2019-14859

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...

SUSE SLED12 Security Update : dia (SUSE-SU-2019:3390-1)

This update for dia fixes the following issue : CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding bsc1158194. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

CVE-2019-20047

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded...

SUSE-SU-2019:3391-1 Security update for dia

This update for dia fixes the following issue: - CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding bsc1158194...

SUSE-SU-2019:3390-1 Security update for dia

This update for dia fixes the following issue: - CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding bsc1158194...

HTTP Request Smuggling

waitress is vulnerable HTTP request smuggling. The vulnerability exists because the library mishandled HTTP request header by not correctly parsing special whitespace characters in the Transfer-Encoding header, causing the parser to use Content-Length header instead to determine the HTTP message...

DEBIAN-CVE-2019-16789

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special...

PYSEC-2019-138

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special...

PYSEC-2019-138

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special...

UBUNTU-CVE-2019-16789

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special...

CVE-2019-16789

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special...

GHSA-M5FF-3WJ3-8PH4 HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress

Impact If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Content-Length: 10 Transfer-Encoding: \x0bchunked For clarity: 0x0b == vertical...

libIEC61850 'BerDecoder_decodeUint32' function buffer overflow vulnerability

libIEC61850 is an open source library for the IEC 61850 protocol. A buffer overflow vulnerability exists in the 'BerDecoderdecodeUint32' function in the mms/asn1/berdecode.c file in libIEC61850 version 1.4.0. The vulnerability stems from a networked system or product performing operations in memo...

PT-2019-6234 · Waitress +3 · Waitress +3

Name of the Vulnerable Software and Affected Versions: Waitress versions 1.4.0 and earlier Description: The issue is related to the incorrect handling of special whitespace characters in the Transfer-Encoding header, which can lead to HTTP request smuggling and potentially result in cache poisoni...

HTTP Request Smuggling

waitress is vulnerable HTTP request smuggling. The vulnerability exists because the library mishandled HTTP request header by not correctly parsing the Transfer-Encoding header, causing the parser to use Content-Length header instead to determine the HTTP message body size, ignoring the requests...

PT-2019-5515 · Openwrt · Openwrt

Name of the Vulnerable Software and Affected Versions: OpenWrt versions 18.06.0 through 18.06.5 OpenWrt versions 19.0 through 19.07.0-rc2 Description: The issue is related to an integer signedness error in the uhttpd function of the OpenWrt embedded operating system, which can lead to out-of-boun...

Command Execution Vulnerability in WDJA Web Content Management System

WDJA Web Content Management System is a set of existing modules can be expanded and cloned PHP open source CMS system , using UTF-8 coding , to take the language/code/program two separate technical modes . WDJA Web Content Management System has a command execution vulnerability that can be...

DEBIAN-CVE-2019-16786

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with t...

CVE-2019-16786

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with t...

PYSEC-2019-137

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with t...