13641 matches found
CVE-2023-46589
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could...
Apache Tomcat 9.0.0.M1 < 9.0.83
The version of Tomcat installed on the remote host is prior to 9.0.83. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.83security-9 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-...
Rocky Linux 8 : nodejs:20 (RLSA-2023:7205)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7205 advisory. - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return ...
Apache Tomcat 10.1.0.M1 < 10.1.16
The version of Tomcat installed on the remote host is prior to 10.1.16. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.16security-10 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from...
Apache Tomcat 8.5.0 < 8.5.96
The version of Tomcat installed on the remote host is prior to 8.5.96. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.96security-8 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-...
GHSA-Q3QX-C6G2-7PW2 aiohttp's ClientSession is vulnerable to CRLF injection via version
Summary Improper validation make it possible for an attacker to modify the HTTP request e.g. to insert a new header or even create a new HTTP request if the attacker controls the HTTP version. Details The vulnerability only occurs if the attacker can control the HTTP version of the request...
CVE-2023-5239
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection...
CVE-2023-5239
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection...
Design/Logic Flaw
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection...
PT-2023-32239 · WordPress · Wassup Real Time Analytics
Name of the Vulnerable Software and Affected Versions: WassUp Real Time Analytics WordPress plugin versions 1.9.4.5 and earlier Description: The issue allows unauthenticated users to perform Stored XSS attacks against logged in admins. This is due to the plugin not escaping IP address provided vi...
Exploit for Incorrect Authorization in Cacti
CVE-2022-46169 Exploit for CVE-2022-46169 Cacti versions befor...
CVE-2023-6263
An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server. As result, it was possible to retrieve authorization headers from legitimate users when the legitima...
CVE-2023-6263
An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server. As result, it was possible to retrieve authorization headers from legitimate users when the legitima...
CVE-2023-6263 Server Spoofing Vulnerability in NxCloud
An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server. As result, it was possible to retrieve authorization headers from legitimate users when the legitima...
squid: DoS against HTTP and HTTPS
A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk...
CVE-2023-27457
Cross-Site Request Forgery CSRF vulnerability in Passionate Brains Add Expires Headers & Optimized Minify plugin = 2.7 versions...
CVE-2023-27457
Cross-Site Request Forgery CSRF vulnerability in Passionate Brains Add Expires Headers & Optimized Minify plugin = 2.7 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Passionate Brains Add Expires Headers & Optimized Minify plugin = 2.7 versions...
CVE-2023-27457
CVE-2023-27457 is a CSRF vulnerability in the WordPress plugin Add Expires Headers & Optimized Minify , affecting versions <= 2.7. The root cause is a Cross Site Request Forgery flaw that could be triggered without authentication guard, with the PatchStack entry noting the vulnerability as low...
GHSA-HX93-GC73-5RPR Exposure of Sensitive Information in Elastic APM .NET Agent
The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers...