181 matches found
MGASA-2023-0061 Updated python-twisted packages fix security vulnerability
When the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. CVE-2022-39348...
SUSE-SU-2023:0553-1 Security update for the Linux Kernel (Live Patch 19 for SLE 15 SP3)
This update for the Linux Kernel 5.3.18-1503005971 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed use-after-free in l2capcore.c of the Bluetooth component bsc1206314. - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits bsc1207139...
USN-5839-1 apache2 vulnerabilities
It was discovered that the Apache HTTP Server moddav module incorrectly handled certain If: request headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. CVE-2006-20001 ZeddYuLu discovered that the Apache HTTP Server modproxyajp...
ALPINE-CVE-2006-20001
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier...
PT-2022-35957 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue concerns the use of struct group to copy ip/ipv6 header addresses in the Linux Kernel. It was introduced in version v4.2 and fixed in version v6.0.10. The actual impact and attack...
PT-2022-12239 · Unknown · Active Intelligent Visualization
Name of the Vulnerable Software and Affected Versions: Active Intelligent Visualization version 5 Description: An issue was discovered where the Vdc header is used in a SQL query without being sanitized, causing SQL injection. Recommendations: For Active Intelligent Visualization version 5,...
AZL-42760 CVE-2022-37434 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call...
DEBIAN-CVE-2022-31813
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application...
ADC 13.0 - Error : Please log on. The server met an error. Please try again or contact your administrator
Error after login to Citrix Gateway: "Please log on The server met an error. Please try again or contact your administrator" Logging in works fine internally through StoreFront server, but fails when trying to log on through Citrix Gateway. The session policy was noted to be looking for a referer...
Haproxy HAProxy 安全漏洞
Haproxy HAProxy is an open source TCP/HTTP load balancing server from the French company HAProxy Haproxy. The server provides Layer 4 and Layer 7 proxies and can support tens of thousands of connection levels with high efficiency and stability. A security vulnerability exists in HAProxy, which...
jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...
USN-4994-2 apache2 vulnerabilities
USN-4994-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Antonio Morales discovered that the Apache modauthdigest module incorrectly handled certain Digest nonces. A remote attacker coul...
OPENSUSE-SU-2021:0772-1 Security update for python-httplib2
This update for python-httplib2 contains the following fixes: Security fixes included in this update: - CVE-2021-21240: Fixed a regular expression denial of service via malicious header bsc1182053. - CVE-2020-11078: Fixed an issue where an attacker could change request headers and body bsc1171998...
PT-2021-11997 · Unknown +3 · Ngx Http Lua Module +3
Name of the Vulnerable Software and Affected Versions: ngx http lua module aka lua-nginx-module versions prior to 0.10.16 Description: The issue allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header. Recommendations: For versions prior to...
Privoxy Code Issue Vulnerability
Privoxy is a proxy server from the Privoxy team in the USA that does not cache web pages and comes with its own filtering features. It has advanced filtering features to enhance privacy, modify web data and HTTP headers, control access and remove advertisements and other annoying Internet...
USN-4532-1 netty-3.9 vulnerabilities
It was discovered that Netty incorrectly handled certain HTTP headers. By sending an HTTP header with whitespace before the colon, a remote attacker could possibly use this issue to perform an HTTP request smuggling attack. CVE-2019-16869 It was discovered that Netty incorrectly handled certain...
SUSE-SU-2020:1792-1 Security update for python3-requests
This update for python3-requests provides the following fix: python-requests was updated to 2.20.1. Update to version 2.20.1: Fixed bug with unintended Authorization header stripping for redirects using default ports http/80, https/443. Update to version 2.20.0: Bugfixes + Content-Type header...
rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can...
Fedora 27 : glibc (2018-c1ef35a4f9)
This update removes a misleading comment from the documentation of the abort function RHBZ1615608. A minor security vulnerability, CVE-2018-11237, a buffer overflow in mempcpy for Xeon Phi RHBZ1581275 has been addressed. The update also fixes the waiters-after-spinning case in the...