CVE-2017-5638

CVE-2017-5638 Dieses Skript dient dazu, die Apache Struts 2 Schwachstelle CVE-2017-5638, auch bekannt als Struts-Shock, zu validieren. Es ist völlig harmlos, da es keine schädliche Nutzlast injiziert, sondern lediglich einen HTTP-Header namens 'STRUTS2-VALIDATION' einfügt, um zu validieren, ob di...

CVE-2025-60876

CVE-2025-60876: correção de injeção no request-target do busybox wget Uma correção que preserva o comportamento para CVE-2025-60876, uma vulnerabilidade de injeção de cabeçalho HTTP no wget do BusyBox, além da prova de conceito que a demonstra e dos artefatos para submeter a correção upstream ao...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Aviso de Segurança: Injeção de Cabeçalho HTTP via CR e LF Não Validados em Valores de Cabeçalho tinyhttp ID CVE Atribuído: CVE-2026-66753 Resumo O tinyhttp não rejeita retorno de carro ou quebra de linha dentro de valores de cabeçalhos HTTP, em nenhuma das direções. No lado da requisição,...

CVE-2017-5638

CVE-2017-5638 Dieses Skript dient zur Validierung der Apache Struts 2-Sicherheitslücke CVE-2017-5638, auch bekannt als Struts-Shock. Es ist völlig harmlos, da es keine schädliche Nutzlast injiziert, sondern lediglich einen HTTP-Header namens 'STRUTS2-VALIDATION' einfügt, um zu überprüfen, ob die...

nextjs-middleware-auth-bypass-lab

Next.js Middleware Authorization Bypass CVE-2025-29927 Qu'est-ce que la vulnérabilité ? Dans les applications Next.js, le middleware s'exécute avant que les requêtes n'atteignent l'application et effectue des contrôles tels que l'authentification et l'autorisation. Dans le cas de la vulnérabilité...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: حقن ترويسة استجابة HTTP CRLF في خادم البث في Mastodon نظرة عامة على الثغرة...

log4jcheck

Northwave Log4j CVE-2021-44228 verificador Sexta-feira, 10 de dezembro de 2021, um novo Proof-of-Concept 1 abordando uma vulnerabilidade de Execução Remota de Código RCE na biblioteca Java 'log4j' 2 foi publicado. Esta vulnerabilidade não foi divulgada antecipadamente aos desenvolvedores do...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-50576

CVE-2026-50576 is a CRLF header injection vulnerability in ePA 3.x Integration , a component of Germany's electronic patient record system. The build_inner_header function in app/vau/VAUProtokoll.py interpolates user-controlled values (uri, host, accept_type, content_type, content_length, USER_AG...

CVE-2026-50576 ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Server-Side Request Forgery

Apache Camel Solr component is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of SolrParam. and SolrField. headers, where attacker-controlled HTTP headers can inject arbitrary Solr request parameters or document fields, allowing unauthorized...

Improper Input Validation

Apache Camel Salesforce is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Salesforce control headers, where attacker-controlled HTTP headers can override configured SOQL queries, SObject parameters, or Apex REST requests, allowing unauthorized acce...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Security Bulletin:Vulnerability in form-data affects IBM Netezza Appliance

Summary The form-data package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-12143 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the fie...

CVE-2026-54199

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.5 Vulnerability Details CVEID:CVE-2025-15366 DESCRIPTION: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing...