4974 matches found
Fedora 17 : Django-1.4.2-1.fc17 (2012-16440)
Security releases issued - Host header poisoning Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
CVE-2012-4520
The django.http.HttpRequest.gethost function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values...
FreeBSD : django -- multiple vulnerabilities (5f326d75-1db9-11e2-bc8f-d0df9acfd7e5)
The Django Project reports : - Host header poisoning Some parts of Django -- independent of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require t...
Fedora 18 : python-django-1.4.2-1.fc18 (2012-16406)
Security releases issued - Host header poisoning Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
django -- multiple vulnerabilities
The Django Project reports: Host header poisoning Some parts of Django -- independent of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require the...
PT-2012-3885 · Mcafee · Mcafee Web Gateway
Name of the Vulnerable Software and Affected Versions: McAfee Web Gateway version 7.0 Description: The issue allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. It is noted that this issue might not ...
PT-2012-3886 · Squid · Squid +1
Name of the Vulnerable Software and Affected Versions: Squid version 3.1.9 Description: The issue allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. Note that this issue might not be reproducible du...
Joomla 2.5.3 Host Header Cross Site Scripting
TITLE ....... Joomla 2.5.3 reflected XSS and/or Information disclosure DATE ........ 26.03.2012 AUTOHR ...... http://hauntit.blogspot.com SOFT LINK ... http://joomla.org VERSION ..... 2.5.3 TESTED ON ... LAMP ----------------------------------------------------------------------- 1. What is this?...
Squid / McAfee Web Gateway URL filtering bypass
Server trusts to Host: header in CONNECT request...
DEBIAN-CVE-2012-0256
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...
CVE-2012-0256
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...
Design/Logic Flaw
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...
CVE-2012-0256
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...
CVE-2012-0256
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...
CVE-2012-0256
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...
CVE-2012-0256
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...
Apache Traffic Server HTTP主机标头处理缓冲区溢出漏洞
BUGTRAQ ID: 52696 CVE ID: CVE-2012-0256 Apache Traffic Server（ATS或TS）是一个高性能的、可扩展的模块化HTTP/1.1缓存代理服务器。 Apache Traffic Server在HTTP协议的实现上存在堆溢出漏洞，通过发送特制的HTTP消息到受影响服务器可造成拒绝访问或执行任意代码。 0 Apache Group Traffic Server 厂商补丁： Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://httpd.apache.org/...
PT-2012-2442
Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 2.0.x through 3.0.3 Apache Traffic Server versions 3.1.x prior to 3.1.3 Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending a long HTTP Host header...
CVE-2012-0256: Improper Restriction of Operations within the Bounds of a Memory Buffer
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service daemon crash via a long HTTP Host header...