CVE-2019-10891

An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnapmain, which calls system without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header. Recent...

CVE-2019-10892: Out-of-bounds Write

An issue was discovered in D-Link DIR-806 devices. There is a stack-based buffer overflow in function hnapmain at /htdocs/cgibin. The function will call sprintf without checking the length of strings in parameters given by HTTP header and can be controlled by users. And it finally leads to a...

PT-2019-12081

Name of the Vulnerable Software and Affected Versions D-Link DIR-806 devices affected versions not specified Description A stack-based buffer overflow issue exists due to the function hnap main at the /htdocs/cgibin endpoint. This function calls sprintf without checking the length of strings in...

CVE-2019-10891: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnapmain, which calls system without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header...

CVE-2019-4186

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

CVE-2019-4186

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

Cross site scripting

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

CVE-2019-4186

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

CVE-2019-4186

CVE-2019-4186 affects IBM Jazz for Service Management 1.1.3, via an HTTP header injection flaw caused by incorrect trust in the Host header during caching. A remote attacker could send a crafted HTTP GET to inject arbitrary headers, enabling attacks such as cross-site scripting, cache poisoning, ...

CVE-2019-4186: Improper Neutralization of Input During Web Page Generation

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

Security Bulletin: IBM Jazz for Service Management is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header (CVE-2019-4186)

Summary IBM Jazz for Service Management is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header. Vulnerability Details CVEID: CVE-2019-4186 DESCRIPTION: IBM Jazz for Service Management is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP...

CVE-2019-1968: Improper Input Validation

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could...

php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c

An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because httpheadervalue in ext/standard/httpfopenwrapper.c can be a NULL value that is mishandled in an atoi call...

PT-2019-3170 · Cisco · Cisco Firepower Services Software For Asa +2

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense Software affected versions not specified Cisco FirePOWER Services Software for ASA affected versions not specified Cisco Firepower Management Center Software affected versions not specified Description: The issu...

CVE-2019-3639 MWG UI: Cross-Frame Scripting vulnerability

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header...

CVE-2019-0338

During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure...

Information disclosure

During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure...

CVE-2019-0338

CVE-2019-0338 affects SAP Gateway’s OData V2/V4 endpoints in SAP (versions 750–753). The HTTP headers cache-control and pragma were not properly set, allowing an attacker to access restricted information and cause Information Disclosure. The connected documents provide the affected product (SAP G...

CVE-2019-0338

During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure...

PT-2019-5669

Name of the Vulnerable Software and Affected Versions SAP Gateway versions 750 through 753 Description The issue is related to the improper setting of HTTP Header attributes cache-control and pragma during an OData V2/V4 request, allowing an attacker to access restricted information. This results...