(0Day) Avira Management Console Update Manager Service HTTP Header Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avira Management Console. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP headers by the Update Manager service. By sending overly...

CVE-2015-6949

Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values...

Stack overflow

Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values...

CVE-2015-6949

The CVE-2015-6949 issue affects the ASUS TM-AC1900 router. A stack-based buffer overflow in the HTTP header parsing routine allows remote attackers to execute arbitrary code by sending crafted HTTP header values, potentially yielding root-privileged code execution. Public references (e.g., NVD en...

CVE-2015-6949

Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values...

CVE-2015-6949: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values...

PT-2015-7423

Name of the Vulnerable Software and Affected Versions ASUS TM-AC1900 router affected versions not specified Description The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code via crafted HTTP header values. This can potentially lead to remote code...

(0Day) ASUS TM-AC1900 httpd Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the ASUS TM-1900. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP header parsing routine. The issue lies in the failure to check the size of...

ownCloud: owncloud.com: Content Sniffing not disabled

URL :- https://owncloud.com Issue description :- There was no "X-Content-Type-Options" HTTP header with the value nosniff set in the response. The lack of this header causes that certain browsers, try to determine the content type and encoding of the response even when these properties are define...

Wavelink Emulation License Server HTTP Header Processing Buffer Overflow (CVE-2015-4059)

A buffer overflow vulnerability exists in Wavelink Emulation License Server. The vulnerability is due to a boundary error when parsing HTTP headers. By sending crafted requests to a vulnerable server, a remote unauthenticated attacker can possibly exploit this vulnerability to execute arbitrary...

Keybase: Content Sniffing not disabled

Issue description :- There was no "X-Content-Type-Options" HTTP header with the value nosniff set in the response. The lack of this header causes that certain browsers, try to determine the content type and encoding of the response even when these properties are defined correctly. This can make t...

NewStatPress <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

An insufficient user input validation of HTTP-Header: "Referer" results in a persistent XSS in the WordPress admin-panel. An attacker may be able to access any cookies, session tokens or other sensitive information retained by the browser and used with that site...

Netgear Prosafe VPN Firewalls - Multiple vulnerabilities

About Encripto AS ================= Encripto is a Norwegian company which provides specialized services within IT-security. Our core expertise is security testing, network security monitoring and training. Encripto is committed to information security. We do research to discover trends, new...

PT-2015-4520

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce versions 6.0 through 6.0.0.11 IBM WebSphere Commerce versions 7.0 before 7.0.0.8 Cumulative iFix 2 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attack...

CVE-2015-4198

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

Cross site scripting

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

CVE-2015-4198

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

PT-2015-6454

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions 8.5.0-497 Description A cross-site scripting XSS issue exists in the web framework, allowing remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header. Recommendations For...

CVE-2015-4198: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

Cisco Web Security Appliance Web Framework HTTP Header Injection Vulnerability

A vulnerability in the web framework of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could introduce arbitrary code into the web interface. The vulnerability is due to insufficient validation of user input before it is used...