802 matches found
Host Spoofing
typo3/cms is vulnerable to Host Spoofing. Improper validation of HTTP Host header allow attackers to forge the header to any value, resulting in impersonation of a legitimate user...
Mitel Networks MiCollab 授权问题漏洞
An authorization issue vulnerability exists in Mitel Networks MiCollab, a mobile application from Mitel Networks Canada that provides voice, video, messaging, audio conferencing, and team collaboration for employees, and stems from the product's MiCollab Client Service component does not validate...
resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class
A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...
CVE-2021-20101
Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content...
Machform 注入漏洞
MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. An HTTP host header injection vulnerability exists in versions prior to Machform 16. The vulnerability stems from improper validation of the host header. An attack...
CVE-2021-23853
In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs...
resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class
A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...
JetBrains YouTrack 跨站脚本漏洞
YouTrack is a keyboard-based issue and project tracking tool from the Czech company JetBrains, primarily used for tracking tasks and defect correction arrangements during development. A cross-site scripting vulnerability exists in versions prior to JetBrains YouTrack 2021.1.9819. The vulnerabilit...
UPnP 数据伪造问题漏洞
UPnP is a Universal Plug and Play protocol from the Open Connectivity Foundation. A data forgery vulnerability exists in Portable SDK version 1.14.6 and later in UPnP Devices because it does not check the value of the "host" header...
Possible request smuggling in HTTP/2 due missing validation of content-length
Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1 This is a followup of...
OPENSUSE-SU-2021:0448-1 Security update for netty
This update for netty fixes the following issues: - CVE-2021-21295: Fixed an improper Content-Length header field validation bsc1183262. : This update was imported from the SUSE:SLE-15-SP2:Update update project...
python: infinite loop in the tarfile module via crafted TAR archive
A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...
NewStart CGSL CORE 5.04 / MAIN 5.04 : python Vulnerability (NS-SA-2021-0015)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python packages installed that are affected by a vulnerability: - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpa...
python: infinite loop in the tarfile module via crafted TAR archive
A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...
python: infinite loop in the tarfile module via crafted TAR archive
A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...
The vulnerability of the Twisted Web network framework’s component, allowing a hacker to cause a service failure
The vulnerability of the Twisted Web network framework’s component involves insufficient validation of input data during the processing of HTTP headers. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
The vulnerability of the Twisted Web network framework’s component, allowing a hacker to cause a service failure
The vulnerability of the Twisted Web network framework’s component involves insufficient validation of input data during the processing of HTTP headers. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
CVE-2020-17438
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafti...
CVE-2020-17438
CVE-2020-17438 affects uIP 1.0 (used in Contiki 3.0 and other products). The IP reassembly code fails to validate the total packet length and fragmentation offset, enabling crafted IP headers to write past the static buffer into the .bss area, causing a denial of service in uip_reass() and potent...