CVE-2022-37177

CVE-2022-37177 - HireVue-Broken-Or-Risky-Cryptographic-Algorithm 当访问 HireVue 为面试提供的面试邀请链接时，你会被引导到一个条款页面，在开始录制并计时的面试过程之前，你需要先同意这些条款。这个初始 HTTP 响应中包含了面试过程中会被问到的面试问题，这些问题使用栅栏密码（rail fence cipher）进行编码。这种编码很容易被解密，因此在实际开始面试之前就能获得所有面试问题。如果你不同意条款，面试就不会开始，所以你可以随意反复访问该链接然后离开，直到你同意开始面试为止。HireVue...

ibm-qradar-ajp_smuggling_CVE-2022-26377_poc

CVE-2022-26377 由 @watchTowr 开发的一个概念验证（PoC），用于利用 AJP Smuggling 漏洞，通过存储的重定向来污染 IBM QRadar 实例的 HTTP 响应队列。 关注 watchTowr 实验室团队，了解我们的安全研究 https://labs.watchtowr.com/ https://twitter.com/watchtowrcyber https://www.ibm.com/support/pages/node/7145265...

CVE-2024-46982-Reproduction

开始使用 1. 安装 Node.js LTS 2. npm install 3. npm run build 4. npm run start 利用方法 1：通过缓存投毒实现存储型 XSS 1. 使用任意 HTTP 客户端发送以下 HTTP 请求（攻击请求）。 GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent: alert'XSS' x-now-route-matches: 1 2. 使用任意 Web 浏览器访问 http://localhost:3000（正常请求）。 利用方法 2：通过缓存投毒实现存储型...

Rocky Linux 8 [CIQ] Security Update: python3.12-urllib3 Multiple Vulnerabilities (crlsa-2026_32992)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202632992 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-origin...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1745053071)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745053071 advisory. - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant t...

Rocky Linux 10.2 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_28000)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202628000 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-orig...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_0970)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230970 advisory. httpd: moddav: out-of-bounds read/write of zero byte CVE-2006-20001 httpd: modproxyajp: Possible request smuggling CVE-2022-36760 httpd: modproxy: HTTP...

Rocky Linux 10.1 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc (crlsa-2026_2410)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262410 advisory. libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response CVE-2026-1761 Tenable has extracted the preceding description...

PT-2026-103929

Out-of-bounds Write vulnerability in Apache HTTP Server's mod proxy html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

Rocky Linux 10.2 [CIQ] Security Update: python3.14-urllib3 Multiple Vulnerabilities (crlsa-2026_27929)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202627929 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-orig...

Rocky Linux 9 [CIQ] Security Update: python3.14-urllib3 Multiple Vulnerabilities (crlsa-2026_28157)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202628157 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-origin...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1725382183)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1725382183 advisory. - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2023_0852)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230852 advisory. httpd: moddav: out-of-bounds read/write of zero byte CVE-2006-20001 httpd: modproxyajp: Possible request smuggling CVE-2022-36760 httpd: modproxy: HTTP...

Rocky Linux 9 [CIQ] Security Update: python3.12-urllib3 Multiple Vulnerabilities (crlsa-2026_28159)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202628159 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-origin...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc (crlsa-2023_5050)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235050 advisory. httpd: modproxyuwsgi HTTP response splitting CVE-2023-27522 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc (crlsa-2024_4197)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244197 advisory. httpd:2.4: httpd: HTTP response splitting CVE-2023-38709 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_9306)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249306 advisory. httpd: HTTP response splitting CVE-2023-38709 httpd: HTTP Response Splitting in multiple modules CVE-2024-24795 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1732194710)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1732194710 advisory. - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1771000442)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771000442 advisory. - A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for...

Rocky Linux 9 [CIQ] Security Update: rubygem-mysql2 / rubygem-mysql2-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_1576)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241576 advisory. ruby/cgi-gem: HTTP response splitting in CGI CVE-2021-33621 ruby: ReDoS vulnerability in URI CVE-2023-28755 ruby: ReDoS vulnerability - upstream's incomple...