RUSTSEC-2020-0031 HTTP Request smuggling through malformed Transfer Encoding headers

HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling attacks CL:TE/TE:TE by sending invalid Transfer Encoding headers. By manipulating the HTTP response the attacker could poison a...

Apsis Pound Environmental Issues Vulnerabilities

Apsis Pound is a reverse proxy program for Web servers from the German company Apsis. The program supports reverse proxy, load balancing and HTTPS front-end and other features. A security vulnerability exists in versions of Apsis Pound prior to 2.8. An attacker can exploit the vulnerability to...

Huawei EulerOS: Security Advisory for nginx (EulerOS-SA-2020-1644)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-21245

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711...

CVE-2018-21245

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711...

Sql injection

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711...

CVE-2018-21245

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711...

CVE-2018-21245

CVE-2018-21245 affects Pound up to version 2.8, enabling HTTP request smuggling due to a vulnerability related to CVE-2016-10711. The issue is described across multiple feeds as a Pound HTTP handling flaw that can impact confidentiality and integrity (per NVD CVSS data: high impact on both C and ...

CVE-2018-21245

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711...

CVE-2018-21245

Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711...

HTTP Request Smuggling

agoo is vulnerable to HTTP request smuggling. When used as a backend and frontend proxy, an attacker is able to leverage TE:CL smuggling attacks by sending a content-length header twice or an invalid Transfer Encoding headers...

HTTP Request Smuggling

goliath is vulnerable to HTTP Request Smuggling. The vulnerability exists as it allows multiple content-length headers to be sent, and prioritizes the second content-length instead of the first...

Unspecified vulnerability in goliath

goliath is an asynchronous framework for writing API servers. A security vulnerability exists in goliath 1.0.6 and earlier versions. An attacker could exploit the vulnerability by sending the Content-Length header twice to conduct an HTTP request smuggling attack. Additionally, it was found that...

CVE-2020-7670

agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct...

CVE-2020-7671

goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to b...

CVE-2020-7671

CVE-2020-7671 affects the goliath framework up to version 1.0.6. The issue enables HTTP request smuggling when goliath is used as a backend and frontend proxy, via sending the Content-Length header twice and due to invalid Transfer-Encoding headers being parsed as valid (TE:CL smuggling). The con...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Go (CVE-2019-16276)

Summary A Security Vulnerability affects IBM Cloud Private - Go Vulnerability Details CVEID: CVE-2019-16276 DESCRIPTION: Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. CVSS Base score: 5.3 CVSS Temporal Score: See:...

tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling

A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line EOL parsing that allowed some invalid HTTP headers to be parsed as valid. This led to the possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the...

HTTP Request Smuggling

reel is vulnerable to HTTP Request Smuggling. The vulnerability exists as it allows the Content-Length header to be sent twice, and also allowing invalid Transfer Encoding headers to be parsed as valid, causing extra content to be valid in the request...

Reel Environmental Issues Vulnerability

Reel is an open source "event-based" Web server . An environmental issue vulnerability exists in Reel 0.6.1 and earlier versions, which can be exploited to conduct HTTP request smuggling attacks because the program does not properly parse the Content-Length and Transfer Encoding headers...