CVE-2019-9900: Improper Neutralization of Special Elements in Output Used by a Downstream Component

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters NUL, ASCII 0x0. This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources...

RHEL 7 : openshift (RHSA-2019:0741)

An update for Istio-Proxy is now available for Red Hat OpenShift Service Mesh Tech Preview 0.9.0. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

Eclipse Jetty Server versions 9.2.x and older, 9.3.x all non HTTP/1.x configurations, and 9.4.x all HTTP/1.x configurations, are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked...

CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x all non HTTP/1.x configurations, and 9.4.x all HTTP/1.x configurations, when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was...

CVE-2017-7656: Inconsistent Interpretation of HTTP Requests

In Eclipse Jetty, versions 9.2.x and older, 9.3.x all configurations, and 9.4.x non-default configuration with RFC2616 compliance enabled, HTTP/0.9 is handled poorly. An HTTP/1 style request line i.e. method space URI space version that declares a version of HTTP/0.9 was accepted and treated as a...

CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2017-10868

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

CVE-2017-10868

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

CVE-2017-10868

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

CVE-2017-10868

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

CVE-2017-10868

CVE-2017-10868 affects H2O Web Server (2.2.2 and earlier). DoS can be triggered remotely by a specially crafted HTTP/1 header, impacting availability. Affected product: H2O; root cause: flaw in HTTP/1 header processing. Remediation: update to the latest version (e.g., 2.2.3 or later) as advised b...

CVE-2017-10868

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

CVE-2017-10868

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

CVE-2017-10868: Improper Input Validation

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header...

PT-2017-11570

Name of the Vulnerable Software and Affected Versions H2O versions 2.2.2 and earlier Description The issue allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header. Recommendations For versions 2.2.2 and earlier, update to a version later than 2.2.2 t...

JVN#84182676: Multiple vulnerabilities in H2O

H2O is an open source web server software. H2O contains multiple vulnerabilities listed below. A Denial-of-service DoS due to a flaw in processing HTTP/1 header CWE-20 - CVE-2017-10868 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS...

JVN#44566208: H2O use-after-free vulnerability

H2O is an open source web server software. H2O contains a use-after-free vulnerability CWE-416 due to a flaw in the process of upgrading from HTTP/1 to HTTP/2. Impact An unauthenticated remote attacker may cause a denial-of-service DoS condition or obtain arbitrary information which may include t...

NetIQ Sentinel Detection

Detection of NetIQ Sentinel The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

The future of loading CSS

Chrome is intending to change the behaviour of , which will be noticeable when it appears within . The impact and benefits of this aren't clear from the blink-dev post, so I wanted to go into detail here. Update: This is now in Chrome Canary. The current state of loading CSS …content… CSS blocks...

linux/x86 HTTP/1.x GET, Downloads and JMP - 68 bytes+

Exploit for linux/x86 platform in category shellcode ===================================================== linux/x86 HTTP/1.x GET, Downloads and JMP - 68 bytes+ ===================================================== / linux/x86 HTTP/1.x GET, Downloads and JMP - 68 bytes+ This shellcode allows you ...