The vulnerability of the NIO-infrastructure client/server architecture for Java Netty, related to the inconsistent interpretation of http requests, allows attackers to compromise data integrity.

The vulnerability of the NIO-server/client infrastructure for Java Netty is related to improper handling of double colon gaps in HTTP headers. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

Cisco Umbrella Carriage Return Line Feed Injection Vulnerability

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this...

Security Bulletin: Multiple vulnerabilities in Node.js affects IBM App Connect Enterprise V11

Summary IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2019-15606 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused ...

CVE-2020-12477

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

Pivotal RabbitMQ X-Reason Denial of Service (CVE-2019-11287)

A denial-of-service vulnerability exists in Pivotal RabbitMQ. The vulnerability is due to indefinite memory consumption when processing an X-Reason HTTP header containing a crafted Erlang format string...

Medium: python-virtualenv

Issue Overview: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in...

netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers

A flaw was found in Netty, where whitespace before the colon in HTTP headers is mishandled. This flaw allows an attacker to cause HTTP request smuggling...

Information Disclosure

httpd is vulnerable to information disclosure. The vulnerability exists as the httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this fla...

Cross-site Scripting (XSS)

Mozilla Firefox is vulnerable to cross-site scripting XSS. It happens due to the way Firefox handled the "Content-Disposition: attachment" HTTP header when the "Content-Type: multipart" HTTP header was also present. A website that allows arbitrary uploads and relies on the "Content-Disposition:...

CVE-2019-9947

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that...

Security Bulletin: Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7

Summary Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7. CVE-2019-9948 and CVE-2019-9947 are fixed in RHEL7 as part of Errata RHSA-2019:2030 https://access.redhat.com/errata/RHSA-2019:2030. This update is included in Resilient 34.1.53, released on September...

python-twisted-web security update

12.1.0-6 - Fix CVE-2019-12387 HTTP Header Injection Resolves: rhbz1721518...

CVE-2019-19000 eSOMS Cachecontrol (Pragma) HTTP Header

For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP headers have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information...

Design/Logic Flaw

TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field...

CVE-2020-9375

The CVE-2020-9375 affects the TP-Link Archer C50 V3 router prior to Build 200318 Rel. 62209. A remote attacker can cause a Denial of Service by sending an HTTP request with an illegal Referer header. A Proof-of-Concept exploit exists (PoC) demonstrating a denial-of-service via crafted Referer hea...

CVE-2020-10792

OpenITCOCKPIT versions up to 3.7.2 are affected: an attacker can cause DEVELOPMENT or STAGING to be selected by sending a hostname in the HTTP Host header containing dev or staging. Root cause is improper handling of Host header input. Impact is configuration of environment options. For remediati...

CVE-2019-12131

An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USERID parameter in an HTTP header, an attacker may impersonate an arbitrary existing user without any authentication. All APPC and SDC setups are affected...

Design/Logic Flaw

An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USERID parameter in an HTTP header, an attacker may impersonate an arbitrary existing user without any authentication. All APPC and SDC setups are affected...

CVE-2019-12131

An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USERID parameter in an HTTP header, an attacker may impersonate an arbitrary existing user without any authentication. All APPC and SDC setups are affected...

Security Bulletin: Multiple vulnerabilities affect IBM PureApplication System

Summary There are multiple vulnerabilities that affect IBM PureApplication System. IBM PureApplication System has addressed vulnerabilities. Vulnerability Details CVEID: CVE-2016-5699 DESCRIPTION: urllib2 and urllib for Python are vulnerable to HTTP header injection, caused by improper validation...