GHSA-2XCM-H7VV-G8M9 Improper Neutralization of Input During Web Page Generation in Jenkins

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers...

Information Exposure

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Information Exposure due to improper handling of HTTP headers in filelib.php. An attacker can access sensitive information by intercepting requests to a caching proxy server that has previously...

F5 Networks BIG-IP : Eclipse Jetty vulnerabilities (K10002140)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K10002140 advisory. - In Eclipse Jetty, versions 9.2.x and older, 9.3.x all configurations, and 9.4.x non-default configuration wi...

CVE-2021-40346

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs...

Stack overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Cookie HTTP header. The issue results...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

DEBIAN-CVE-2021-31618

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating...

CVE-2021-1486

A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts. This vulnerability is due to the improper handling of HTTP headers. An attacker could exploit this vulnerability by sending authenticated requests to an affected system. A...

Cisco Firepower Threat Defense 安全特征问题漏洞

Cisco Firepower Threat Defense FTD is a suite of unified software from Cisco that provides next-generation firewall services. Cisco Firepower Threat Defense FTD suffers from a security signature issue vulnerability that results from incorrect handling of specific HTTP header parameters. A remote...

PT-2021-3083 · Cisco · Cisco Isrv +5

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD versions affected versions not specified Cisco Catalyst versions affected versions not specified Cisco ISR versions affected versions not specified Cisco ISA versions affected versions not specified Cisco IS...

Accusoft ImageGear out-of-bounds write vulnerability (CNVD-2021-12104)

Accusoft ImageGear is a multi-platform, multi-language document imaging developer toolkit. An out-of-bounds write vulnerability exists in the PSD Header handling feature of Accusoft ImageGear 19.8. An attacker could exploit this vulnerability via specially crafted files to achieve code execution...

The vulnerability of the Node.js software platform is related to an error in handling HTTP headers, which allows attackers to trigger a service failure.

The vulnerability of the Node.js software platform is related to an error in handling HTTP header names. Exploiting this vulnerability can allow a remote attacker to cause service failures...

librabbitmq: integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer overflow

An issue was discovered in amqphandleinput in amqpconnection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTIONSTATEHEADER. A rogue server could return a malicious frame header that leads to a smaller targetsize value than needed...

PT-2020-15892 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.15.0 Description: The issue arises because Envoy only considers the first value when multiple header values are present for some HTTP headers. Additionally, Envoy's setCopy header map API does not replace all existin...

envoyproxy/envoy: incorrectly handles multiple HTTP headers in requests

An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. Envoy then forwards all of the headers as valid to the upstream component. This issue allows an attacker to subvert any...

librabbitmq: integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer overflow

An issue was discovered in amqphandleinput in amqpconnection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTIONSTATEHEADER. A rogue server could return a malicious frame header that leads to a smaller targetsize value than needed...

Cesanta Mongoose Buffer Overflow Vulnerability

Cesanta Mongoose is a set of embedded server libraries from the Irish company Cesanta, which includes features such as TCP, HTTP client and server, WenSocket client and server. A buffer overflow vulnerability exists in Cesanta Mongoose version 6.18. The vulnerability stems from the mggethttpheade...

PT-2020-5094 · Node.Js +1 · Node.Js +1

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 14.11.0 Description: The issue is related to an error in handling HTTP header names, which can be exploited by a remote attacker to cause a denial of service DoS. This can make the server unable to accept new...

The vulnerability of the Jenkins automation server, related to errors in handling HTTP headers, allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the Jenkins automation server is related to errors in handling HTTP headers. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...

The vulnerability of the software for implementing the hypertext environment MediaWiki, related to the transmission of invalid headers in the API, allows a violator to gain unauthorized access to protected information.

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...