16920 matches found
CVE-2022-0343
A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user typically a developer manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2...
Design/Logic Flaw
A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user typically a developer manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2...
OPENSUSE-SU-2022:1031-1 Security update for apache2
This update for apache2 fixes the following issues: - CVE-2022-23943: heap out-of-bounds write in modsed bsc1197098. - CVE-2022-22720: HTTP request smuggling due to incorrect error handling bsc1197095. - CVE-2022-22719: use of uninitialized value of in r:parsebody in modlua bsc1197091. -...
CVE-2022-0343 Local Priviledge escalation in Perfetto Dev scripts
A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user typically a developer manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2...
CVE-2022-0343 Local Priviledge escalation in Perfetto Dev scripts
A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user typically a developer manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2...
CVE-2022-0343
CVE-2022-0343 affects Perfetto Dev scripts. A local attacker who can run the dev server (./tools/run-dev-server) may trigger HTTP requests to 127.0.0.1:10000, enabling a local privilege/escalation scenario. The issue is tied to the dev-server workflow rather than a remote vector. Remediation: upg...
CVE-2022-25420
NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a crafted HTTP request...
Design/Logic Flaw
NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a crafted HTTP request...
CVE-2022-25420
NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a crafted HTTP request...
RHEL 7 : httpd24-httpd (RHSA-2022:1075)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1075 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Errors encountered during...
RHEL 8 : httpd:2.4 (RHSA-2022:1072)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1072 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Errors encountered during...
RHEL 8 : httpd:2.4 (RHSA-2022:1080)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1080 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Errors encountered during...
Node.js: HTTP Request Smuggling Due To Improper Delimiting of Header Fields
Summary: The llhttp parser in the http module in Node v17.8.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. Description: The LF character without CR is sufficient to delimit HTTP header fields in the lihttp parser. According to...
Node.js: HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding
Summary: The llhttp parser in the http module in Node v17.8.0 does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: After 1501679, I did a bit more digging into the issue, and found that there were more flaws in the parsing of...
Important: Red Hat Security Advisory: httpd:2.4 security update
An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Open Redirection
Description Open redirect security flaw an attacker to redirect the victims of the application into malicious sites Proof of Concept Request POST /create-table/ HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept:...
Stack overflow
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service DoS or potentially results in code execution in the firewall...
CVE-2022-22274
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service DoS or potentially results in code execution in the firewall...
CVE-2022-22274
CVE-2022-22274 is a stack-based buffer overflow in SonicWall’s SonicOS web interface triggered by an HTTP request. The vulnerability allows a remote, unauthenticated attacker to cause Denial of Service and potentially execute code on affected devices. Public sources consistently tie this to the S...