Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the modmacro module of the Apache HTTP Server. This issue affects the Apache HTTP Server version up to 2.4.57...

Astra Linux – Vulnerability in Apache2

The “Use After Free” vulnerability in the Apache HTTP Server module modhttp2 occurs when file handles are already exhausted. This issue affects Apache HTTP Server versions 2.4.55 through 2.4.67...

Astra Linux – Vulnerability in Node.js

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerabili...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability in Apache Tomcat when using the APR/Native connector, involving concurrent execution with shared resources and improper synchronization known as “race condition”. This issue is particularly noticeable during client-initiated closures of HTTP/2 connections. This issue...

Astra Linux – Vulnerability in curl

There is a vulnerability in curl version 7.87.0 where it is possible to exploit the memory reclamation mechanism. In this vulnerability, curl can be instructed to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can and often do deny such tunnel operations. When curl...

Astra Linux – Vulnerability in JRuby

Before Ruby 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an HTTP Response Splitting attack was possible. An attacker could inject a crafted key and value into an HTTP response for the WEBrick HTTP server...

BIT-APACHE-2026-56153 Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-48005 Apache HTTP Server: mod_auth_digest reauthentication attack

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

BIT-APACHE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

BIT-APACHE-2026-46729 Apache HTTP Server: mod_heartmonitor denial of service

NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-42528 Apache HTTP Server: mod_dav shared lock overflow

A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue...

BIT-APACHE-2026-42356 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

BIT-ENVOY-2020-8659

CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small i.e. 1 byte chunks...

http-terminator

http-terminator Un pipeline de recherche assisté par IA pour découvrir et exploiter les vulnérabilités de contrebande de requêtes HTTP / désynchronisation de réponses. Publié comme compagnon de référence pour la recherche ; certaines parties sont exécutables voir la matrice ci-dessous. Le pipelin...

CVE-2024-57778

CVE-2024-57778 Description : Un problème dans Orbe ONetView Roteador Onet-1200 permet à un attaquant distant d'élever ses privilèges via la réponse du serveur, du code de statut 500 au code de statut 200. Versions : Découvert dans Orbe ONetView Roteador Onet-1200 Orbe 1680210096, mais applicable ...

cve-2021-41773

Cve-2021-41773-grabber ثغرة اجتياز المسار وكشف الملفات في خادم Apache HTTP Server 2.4.49 هذا السكربت يجمع الخوادم المعرضة لثغرة CVE-2021-41773 من Shodan طريقة الاستخدام: استخدم Python 3 ثبّت وحدة Shodan " pip install shodan" غيّر الكلمة المفتاحية في السكربت إلى كلمتك المفتاحية من Shodan تحتاج إلى...

[SECURITY] [DLA 4821-1] perl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4821-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout October 05, 2026 https://wiki.debian.org/LTS -...

CVE-2025-55182

CVE-2025-55182 — React2Shell ثغرة تنفيذ تعليمات برمجية عن بُعد حرجة في مكونات React Server Components. الخطورة: حرجة | CVSS v3.1: 10.0 الحد الأقصى | الحالة: يتم استغلالها بنشاط ما هذا؟ React2Shell هي ثغرة أمنية حرجة في React Server Components RSC — وهي ميزة حديثة تسمح لـ React بتشغيل أجزاء من تطب...

CVE-2025-60752

CVE-2025-60752 إثبات المفهوم PoC لـ CVE-2025-60752 المنتج المتأثر: Tinyc Http Server المقال الكامل متاح على https://zer0matt.blogspot.com/2026/05/cve-2025-60752-tinyc-http-server-stack.html الوصف يحدث تجاوز سعة المخزن المؤقت للمكدس stack buffer overflow عندما يتلقى Tinyc إدخالًا معدًا بعناية. يحد...

docker-lab-cve-2017-5638-cve-2021-41773

Attacker Lab: CVE-2017-5638 & CVE-2021-41773 Un laboratoire d'émulation d'attaques basé sur Docker avec 7 hôtes, conçu pour démontrer une kill chain en plusieurs étapes, le mouvement latéral et la détection IDS multi-points. Vue d'ensemble Ce laboratoire simule un environnement réseau réaliste da...