The vulnerability of the Apache HTTP Server web server, related to uncontrolled resource consumption, allows attackers to cause service interruptions.

The vulnerability of the Apache HTTP Server’s web server in terms of the implementation of the HTTP/2 protocol is related to an uncontrolled resource consumption due to incorrect determination of the end of headers during the processing of CONTINUATION requests. Exploiting this vulnerability can...

AZL-38233 CVE-2023-45288 affecting package jx for versions less than 3.10.116-2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-38473 CVE-2023-45288 affecting package prometheus-node-exporter for versions less than 1.7.0-2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-39505 CVE-2023-45288 affecting package node-problem-detector for versions less than 0.8.17-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

The vulnerability of the Apache Tomcat application server, related to insufficient input validation, allows attackers to cause service failures.

The vulnerability of the Apache Tomcat application server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to cause service failures through specially crafted HTTP/2 requests...

PT-2024-2623 · Tempesta · Tempesta

Name of the Vulnerable Software and Affected Versions: Tempesta affected versions not specified Description: The issue is related to a firewall vulnerability in the implementation of the HTTP/2 protocol, specifically concerning the handling of CONTINUATION frames. This can lead to an uncontrolled...

python-aiohttp: numerous issues in HTTP parser with header parsing

An HTTP request smuggling vulnerability was found in aiohttp. Numerous issues with HTTP parsing can allow an attacker to smuggle HTTP requests...

The vulnerability of the aiohttp HTTP client, related to deficiencies in handling HTTP request headers, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the aiohttp HTTP client is related to deficiencies in the handling of HTTP request headers. Exploiting this vulnerability allows an attacker to send hidden HTTP requests remotely HTTP Request Smuggling attack...

The vulnerability of the Captive Portal authentication system for operating systems FortiOS and proxy servers, designed to protect against Internet attacks by FortiProxy, allows a perpetrator to execute arbitrary codes or commands.

The vulnerability of Captive Portal for FortiOS operating systems and proxy servers, designed to protect against Internet attacks using FortiProxy, is related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or commands through...

UBUNTU-CVE-2024-24568

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3...

Weston Embedded uC-HTTP Security Vulnerability

Weston Embedded uC-HTTP is an embedded HTTP service from Weston Embedded. A security vulnerability exists in Weston Embedded uC-HTTP that stems from a heap-based buffer overflow vulnerability in the HTTP server functionality...

The vulnerability of the implementation of the PPTP protocol by the microprogramming-based VPN router TP-Link ER7206 Omada allows a perpetrator to execute arbitrary commands.

The vulnerability of the PPTP protocol implementation in the TP-Link ER7206 Omada VPN router software exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through ports 80/443 remotely...

CVE-2024-20947

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

The vulnerability of the http parser() function in the Apache bRPC RPC framework allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the http parser function in the Apache bRPC RPC framework is related to a discrepancy in the RFC-7230 HTTP 1.1 specification regarding the handling of HTTP requests when processing fields such as Transfer-Encoding and Content-Length. Exploiting this vulnerability allows an...

The vulnerability of HTTP/3 QUIC modules in NGINX Plus and NGINX OSS web servers allows attackers to cause service interruptions.

The vulnerability of HTTP/3 QUIC in NGINX Plus and NGINX OSS web servers is related to the swapping of the zero pointer. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending specially crafted requests...

CVE-2024-23314

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

squid: Buffer over-read in the HTTP Message processing feature

A buffer over-read flaw was found in Squid's HTTP Message processing feature. This issue may allow attackers to perform remote denial of service...

The vulnerability of the sub-component “Engineering Change Order” of the “Oracle Application Object Library” component in the Oracle E-Business Suite system, which allows a malicious actor to gain access to read, modify, add, or delete data.

The vulnerability of the Login component – SSO in the Oracle Application Object Library exists due to insufficient validation of input data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain access to read, modify, add, or delete data using the HTTP protocol...

The vulnerability of the sub-component of the CRM User Management Framework in the Oracle Common Applications of the Oracle E-Business Suite allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the CRM User Management Framework component of the Oracle Common Applications system, part of the Oracle E-Business Suite, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to read, modify, add, or delete...

The vulnerability of the Documents component of the Oracle One-to-One Fulfillment application system, a business automation solution from Oracle E-Business Suite, allows an attacker to gain access to read, modify, add, or delete data.

The vulnerability of the Documents component in the Oracle One-to-One Fulfillment system, a business automation solution from Oracle E-Business Suite, exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to...