CVE-2025-10392 Mercury KM08-708H GiGA WiFi Wave2 HTTP Header stack-based overflow

A vulnerability was detected in Mercury KM08-708H GiGA WiFi Wave2 1.1.14. This affects an unknown function of the component HTTP Header Handler. The manipulation of the argument Host results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be...

Linux Distros Unpatched Vulnerability : CVE-2023-30536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and value...

SUSE CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

UBUNTU-CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

PT-2025-35161

Name of the Vulnerable Software and Affected Versions: CGI::Simple versions prior to 1.282 Description: CGI::Simple contains a HTTP response splitting flaw that allows HTTP response header injection. This can be exploited to perform reflected cross-site scripting XSS, open redirect, cache...

Linux Distros Unpatched Vulnerability : CVE-2022-39369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS librar...

Linux Distros Unpatched Vulnerability : CVE-2016-7965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remot...

Linux Distros Unpatched Vulnerability : CVE-2022-45060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce...

Linux Distros Unpatched Vulnerability : CVE-2023-29401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header...

PT-2025-31355 · Koa · Koa

Name of the Vulnerable Software and Affected Versions: Koa affected versions not specified Description: The back method used for redirect operations in Koa utilizes the user-controllable Referrer header as the redirect target, creating an open redirect condition. The response.redirect function,...

CVE-2025-8129

CVE-2025-8129 affects Koa (Koa up to v3.0.0). The vulnerability lies in lib/response.js where manipulation of Referrer can trigger an open redirect. Exploitation is remote and the exploit has been disclosed publicly. Remediation per public sources is to upgrade Koa to a version that contains the ...

Exploit for CVE-2025-29927

CVE‑2025‑29927 – Next.js Middleware Authorization Bypass O...

GHSA-76C9-3JPH-RJ3Q on-headers is vulnerable to http response header manipulation

Impact A bug in on-headers versions 1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead Patches Users should upgrade to 1.1.0 Workarounds Uses are encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object t...

Improper Handling of Unexpected Data Type

Overview Affected versions of this package are vulnerable to Improper Handling of Unexpected Data Type via the response.writeHead function. An attacker can manipulate HTTP response headers by passing an array to this function, potentially leading to unintended disclosure or modification of header...

CVE-2025-7339 on-headers vulnerable to http response header manipulation

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions 1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead. Users should upgrade to version 1.1.0 to receive a patch. Uses are...

CVE-2025-7339

CVE-2025-7339 describes a vulnerability in the on-headers Node.js middleware where a bug in versions < 1.1.0 may cause response headers to be modified when an array is passed to response.writeHead(). The issue is patched in 1.1.0; users are urged to upgrade. A workaround is to pass an object t...

CVE-2025-7339 on-headers vulnerable to http response header manipulation

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions 1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead. Users should upgrade to version 1.1.0 to receive a patch. Uses are...

CVE-2025-7567

A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipulation of the argument lang/systemtype leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed t...

CVE-2025-49827

CVE-2025-49827 affects CyberArk Conjur OSS (versions 1.19.5–1.22.0) and Secrets Manager, Self-Hosted (13.1–13.5, 13.6). Root cause is bypass of the IAM authenticator via manipulation of AWS-signed headers and a malformed regex that redirects the authentication validation request to a attacker-con...

CVE-2025-7567

A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipulation of the argument lang/systemtype leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed t...