13698 matches found
PT-2022-3546 · Profinet · Profinet
Name of the Vulnerable Software and Affected Versions: PROFINET PNIO stack versions affected versions not specified Description: The issue is related to the improper handling of internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an...
PT-2022-3540 · Siemens · Scalance X310 +14
Name of the Vulnerable Software and Affected Versions: SCALANCE X302-7 EEC 230V SCALANCE X302-7 EEC 230V, coated SCALANCE X302-7 EEC 24V SCALANCE X302-7 EEC 24V, coated SCALANCE X302-7 EEC 2x 230V SCALANCE X302-7 EEC 2x 230V, coated SCALANCE X302-7 EEC 2x 24V SCALANCE X302-7 EEC 2x 24V, coated...
UPS VDP: Reflected XSS on https://wwwapps.ups.com/ctc/request?loc=
Summary: ========= Detalis XSS ----------- Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a...
QNAP QTS / QuTS hero Insufficient HTTP Security Headers (QSA-21-03)
The version of QNAP QTS or QuTS hero on the remote host is affected by a vulnerability involving insufficient HTTP security headers. This vulnerability allows remote attackers to launch privacy and security attacks. Note that Nessus has not tested for this issue but has instead relied only on the...
GHSA-C2JG-HW38-JRQQ Inconsistent Interpretation of HTTP Requests in twisted.web
The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230: 1. The Content-Length header value could have a + or - prefix. 2. Illegal characters were permitted in chunked extensions, such as the LF \n...
Inconsistent Interpretation of HTTP Requests in twisted.web
The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230: 1. The Content-Length header value could have a + or - prefix. 2. Illegal characters were permitted in chunked extensions, such as the LF \n...
CVE-2022-1165
The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search...
CVE-2022-26616
PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...
CVE-2022-26616
PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...
Cross site scripting
PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...
CVE-2022-26616
CVE-2022-26616 affects PKP Vendor Open Journal System versions 2.4.8 through 3.3.8. The vulnerability is a reflected cross-site scripting (XSS) flaw exploitable via crafted HTTP headers, allowing an attacker to inject script that is reflected in the user’s response. Connected sources (Red Hat, NV...
CVE-2022-26616
PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...
Unable to launch desktop via Gateway in invoked mode ( Client Detection done and selected workspace to Always Open ICA file )
Unable to launch desktop via Gateway in invoked mode. ICA launch works downloading the file, non invoked mode and clicking on it works In the non-working response for ICA file download, we see Riverbed headers highlighted and the "Connection: close" header being stripped...
CVE-2022-28145
Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting XSS exploitable by attackers with Item/Configure permission or otherwise able to control report contents...
VulnCheck KEV: CVE-2019-10068
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution...
PT-2022-28159 · Guzzle +3 · Guzzlehttp/Psr7 +3
Name of the Vulnerable Software and Affected Versions: guzzlehttp/psr7 versions prior to 1.9.1 guzzlehttp/psr7 versions prior to 2.4.5 Description: The issue concerns improper header parsing, allowing an attacker to sneak in a newline into both the header names and values. Many servers will also...
Kentico Xperience Deserialization of Untrusted Data Vulnerability
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution...
dev-python/twisted: secret exposure in cross-origin redirects
A flaw was found in the twisted Python library when WebClient redirects via the RedirectAgent and BrowserLikeRedirectAgent methods. This flaw allows an attacker to take advantage of these cross-origin redirects and leak the cookie and authorization headers...
Inproper parsing of HTTP headers
Impact Improper header parsing. An attacker could sneak in a carriage return character \r and pass untrusted values in both the header names and values. Patches The issue is patched in 1.8.4 and 2.1.1. Workarounds There are no known workarounds. References...
