16923 matches found
SUSE: Security Advisory (SUSE-SU-2022:14914-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
The grav application allows large characters to insert in the input field "Full Name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request
Proof of Concept: 1. Go to http://site/admin/accounts/users/testuser 2. There will a Full name input field 3. Add more than 1 lakhs+ characters to the Full name field 4. You will see the application accepts large characters and if we will increase the characters then it can lead to Dos. POC Image...
CVE-2022-0968
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12...
Design/Logic Flaw
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0968 The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0968 The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0968
The CVE-2022-0968 entry concerns Microweber up to version 1.2.12, where allowing large characters in the first/last name input can trigger a Denial of Service via a crafted HTTP request. The NUCLEI template and Red Hat/NVD records corroborate an issue tied to input handling (first & last name fie...
Design/Logic Flaw
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0961 The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-22720
A flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling. Mitigation There are currently no known mitigations for this issue...
SUSE-SU-2022:14914-1 Security update for squid3
This update for squid3 fixes the following issues: - CVE-2021-28651: Fixed a denial of service issue when processing URN resource identifiers bsc1185921. - CVE-2020-25097: Fixed an HTTP request smuggling issue bsc1183436...
HTTP Request Smuggling
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling...
[slackware-security] httpd
New httpd packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/httpd-2.4.53-i586-1slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: modsed:...
The microweber application allows large characters to insert in the input field "SKU" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
Go to add post http://site.com/admin/product/create click on create new product There will a option called SKU Fill the input field with huge characters, more than 1 lakh Copy the below payload and put it in the input fields and click on continue. You will see the application accepts large...
The microweber application allows large characters to insert in the input field "Leave comment" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
Proof of Concept 1. Go to http://site/admin/view:content/action:posts 2. Create a page and enable to add comment option 3. Go to that page and there will a option called "Leave a comment" 4. Copy the below payload and put it in the "Leave a comment" field post a comment 5. Go to...
SUSE-SU-2022:14908-1 Security update for squid
This update for squid fixes the following issues: - CVE-2020-15810: Fixed a HTTP Request Smuggling that could have resulted in cache poisoning bsc1175664. - CVE-2019-12523: Disabled urn parsing and parsing of unknown schemes bsc1156329. - CVE-2019-18676: Disabled urn parsing and parsing of unknow...
CVE-2022-22720
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling...
CVE-2022-22720
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling...
Design/Logic Flaw
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling...