CVE-2022-24595

Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP or WebSocket request to the socket listened by the afb-daemon process. No...

Ubuntu: Security Advisory (USN-5333-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5333-2: Apache HTTP Server vulnerabilities

USN-5333-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Chamal De Silva discovered that the Apache HTTP Server modlua module incorrectly handled certain crafted request bodies. A remote...

Internet Bug Bounty: Use of uninitialized value of in req_parsebody method of lua_request.c

Software Versions Ubuntu - 18.04 64-bit Apache 2.4.51 - 64 bit Cause of Bug This bug is present in the reqparsebody method of luarequest.c file. Below mentioned lines of code cause this bug. cpp const char data; int i; sizet vlen = 0; sizet len = 0; if luareadbodyr, &data, aprofft &size,...

CVE-2022-24761 HTTP Request Smuggling in waitress

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

USN-5333-1: Apache HTTP Server vulnerabilities

Chamal De Silva discovered that the Apache HTTP Server modlua module incorrectly handled certain crafted request bodies. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. CVE-2022-22719 James Kettle discovered that the Apache HTTP Serv...

CVE-2022-24761

An Inconsistent Interpretation of HTTP Requests HTTP Request Smuggling flaw was found in Waitress when used behind a proxy that does not properly validate the incoming HTTP request. This flaw allows an attacker to smuggle requests via the front-end proxy to Waitress, resulting in a loss of data...

PT-2022-4802 · Waitress +5 · Waitress +5

Name of the Vulnerable Software and Affected Versions: Waitress versions 2.1.0 and prior Description: The issue is related to the handling of HTTP requests in Waitress, a Web Server Gateway Interface server for Python 2 and 3. When used behind a proxy that does not properly validate incoming HTTP...

Ubuntu 18.04 LTS / 20.04 LTS : Apache HTTP Server vulnerabilities (USN-5333-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5333-1 advisory. Chamal De Silva discovered that the Apache HTTP Server modlua module incorrectly handled certain crafted request bodies. A remote attacker...

SUSE SLES11 Security Update : squid3 (SUSE-SU-2022:14914-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14914-1 advisory. - CVE-2021-28651: Fixed a denial of service issue when processing URN resource identifiers bsc1185921. - CVE-2020-25097: Fixed an HTTP request...

Microweber post title denial of service vulnerability

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. A denial of service vulnerability exists in versions of Microweber prior to 1.2.12. The vulnerability stems from the fact that the application allows large characters to be inserted in...

ROS-20220317-01

Apache HTTP Server web server vulnerability is related to a bounds error in LimitXMLRequestBody. Exploitation vulnerability could allow an attacker acting remotely to cause memory corruption and execute arbitrary code on the target system Apache HTTP Server web server vulnerability is related to...

SUSE SLES11 Security Update : squid (SUSE-SU-2022:14908-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14908-1 advisory. - CVE-2020-15810: Fixed a HTTP Request Smuggling that could have resulted in cache poisoning bsc1175664. - CVE-2019-12523: Disabled urn parsin...

CVE-2022-0959

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write...

CVE-2022-0959

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write...

Denial Of Service (DoS)

microweber/microweber is vulnerable to denial of service DoS attacks. A malicious user is able to insert large characters to the post title input field via a crafted HTTP request, causing the application to crash...

Denial of service in microweber

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. The post title input can be limited...

GHSA-HRF4-HCPC-3345 Denial of service in microweber

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. The post title input can be limited...

Integer Overflow in microweber

Microweber is a new generation CMS with drag and drop. The microweber application allows large characters to insert in the input field "first & last name" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. The first name & last name input should be limited to 5...

FreeBSD : Apache httpd -- Multiple vulnerabilities (6601c08d-a46c-11ec-8be6-d4c9ef517024)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6601c08d-a46c-11ec-8be6-d4c9ef517024 advisory. - A carefully crafted request body can cause a read to a random memory area which could cause...