PT-2024-2334

Name of the Vulnerable Software and Affected Versions LibHTP versions prior to 0.5.46 Description The issue is related to excessive processing time of HTTP headers, leading to denial of service when crafted traffic is sent. This can be exploited by a remote attacker to cause a denial of service...

The vulnerability of Firefox browser, related to insufficient protection of service data, allows attackers to gain unauthorized access to protected information.

The vulnerability of Firefox browsers is related to insufficient protection of service data during the processing of the Vary response header for comparing request headers. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by sending iterativ...

The vulnerabilities of the CompressorStreamFactory, TarArchiveInputStream, and TarFile classes in the Apache Commons Compress library allow a attacker to trigger a service failure.

The vulnerabilities of the CompressorStreamFactory, TarArchiveInputStream, and TarFile classes in the Apache Commons Compress library are related to an uncontrolled resource consumption due to insufficient validation of input data during the processing of TAR archive headers. Exploiting these...

The vulnerability of the cURL command-line utility interface allows a hacker to trigger a service failure.

The vulnerability of the cURL command-line utility interface relates to the allocation of unlimited memory during the processing of HTTP headers. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the Mutt mail client, related to errors in pointer aliasing, allows a hacker to trigger a service failure.

The vulnerability of the Mutt mail client is related to errors in pointer manipulation when processing message headers. Exploiting this vulnerability can allow an attacker to cause a service failure...

haproxy: request smuggling attack in HTTP/1 header parsing

A flaw was found in HAProxy's headers processing that causes HAProxy to drop important headers fields such as Connection, Content-length, Transfer-Encoding, and Host after having partially processed them. A maliciously crafted HTTP request could be used in an HTTP request smuggling attack to bypa...

The vulnerability of the mod_proxy module in the Apache HTTP Server allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the modproxy module in the Apache HTTP Server is related to deficiencies in header processing for Transfer-Encoding. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely HTTP Request Smuggling attack...

PT-2023-2356 · Libde265 +5 · Libde265 +5

Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.11 Description: The issue is related to a segmentation violation via the decoder context::process slice segment header function at decctx.cc. This vulnerability is associated with pointer dereference errors in the h.265...

UBUNTU-CVE-2023-25725

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some...

The vulnerability in the implementation of the `rejectIllegalHeader` attribute in the Apache Tomcat application server allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the Apache Tomcat application server’s implementation of the rejectIllegalHeader attribute is related to deficiencies in the processing of HTTP requests containing the Content-Length header. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests...

The vulnerability of the miniz data compression library, related to integer overflow, allows attackers to cause service failures.

The vulnerability of the miniz data compression library is related to integer overflows during the processing of file headers. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

The vulnerability of the SonicOS operating system arises due to a boundary error in processing the HTTP-response header SessionID, allowing an attacker to execute arbitrary code.

The vulnerability of the SonicOS operating system is caused by an overflow in the stack buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure...

CVE-2022-29465

An out-of-bounds write vulnerability exists in the PSD Header processing memory allocation functionality of Accusoft ImageGear 20.0. A specially-crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

grub2: Out-of-bound write when handling split HTTP headers

A flaw was found in grub2 when handling split HTTP headers. While processing a split HTTP header, grub2 wrongly advances its control pointer to the internal buffer by one position, which can lead to an out-of-bounds write. This flaw allows an attacker to leverage this issue by crafting a maliciou...

GSD-2022-1002524 input validation (CWE-20) in Elastic Load Balancer (ELB) version ELB prior to 2022-01-29 when "Legacy cache settings" is enabled

In Amazon Elastic Load Balancer ELB prior to 2022-01-29 when "Legacy cache settings" is enabled an input validation CWE-20 vulnerability exists in the HTTP Header processing that can be attacked via the network using a trailing space in the requests resulting in HTTP Header Smuggling...

Design/Logic Flaw

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0...

The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus relates to errors in processing ICMP packet headers. This vulnerability allows attackers to gain access to protected information or cause service interruptions.

The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus is related to errors in processing ICMP packet headers. Exploiting this vulnerability can allow a remote attacker to gain access to protected...

The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus relates to errors in processing TCP packet headers. This vulnerability allows attackers to gain access to protected information or cause service interruptions.

The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus is related to errors in processing the TCP header. Exploiting this vulnerability can allow an attacker to gain access to protected informatio...

SUSE-SU-2021:3672-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2021-30640: Escape parameters in JNDI Realm queries bsc1188279. - CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients bsc1188278. - CVE-2021-41079: Fixed a denial of service caused by an unexpected TLS packet...

CVE-2021-31401

An issue was discovered in tcprcv in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field header length + data length. With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is...