golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

CVE-2023-21850

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain component: E-Business Collections. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business...

golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

Cisco BroadWorks Application 输入验证错误漏洞

Cisco BroadWorks Application is an enterprise-class calling and collaboration platform from Cisco USA. A security vulnerability exists in the Cisco BroadWorks Application Delivery Platform that stems from improper input validation when parsing HTTP, which can lead to a denial of service...

CVE-2017-16287

Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker...

The vulnerability of the Moodle course management system lies in the insufficient verification of the HTTP source in the URL address of the course redirect. This allows attackers to execute attacks by manipulating inter-site requests.

The vulnerability of the Moodle course management system is related to insufficient verification of the HTTP source in the URL address of the course redirect. Exploiting this vulnerability allows a malicious actor to carry out attacks by manipulating inter-site requests...

CVE-2022-47895

In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files...

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

...

CVE-2022-2640

The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol FTP and Hypertext Transfer Protocol HTTP...

Horner Automation Remote Compact Controller 加密问题漏洞

The Horner Automation Remote Compact Controller Horner Automation RCC is a compact controller from Horner Automation, USA. A vulnerability exists in Horner Automation Remote Compact Controller 972 firmware version 15.40 due to an encryption issue in the configuration file using weak XOR encryptio...

varnish: Request Forgery Vulnerability

An HTTP Request Forgery issue was discovered in Varnish Cache. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit...

varnish: Request Forgery Vulnerability

An HTTP Request Forgery issue was discovered in Varnish Cache. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit...

PT-2022-26137 · Opensearch · Opensearch Notifications Plugin

Name of the Vulnerable Software and Affected Versions: OpenSearch Notifications Plugin versions 2.0.0 through 2.2.0 Description: A potential Server-Side Request Forgery SSRF issue in the OpenSearch Notifications Plugin could allow an existing privileged user to enumerate listening services or...

Powercom UPSMON PRO 安全漏洞

Powercom UPSMON PRO is a multi-platform client-server software from Powercom that allows remote monitoring and control of a UPS via SNMP, HTTP and UDP. A security vulnerability exists in Powercom UPSMON PRO, which arises from the explicit transmission of sensitive data over the HTTP protocol that...

PT-2022-24216 · Unknown · Upsmon Pro

Name of the Vulnerable Software and Affected Versions: UPSMON PRO affected versions not specified Description: The issue allows an unauthenticated remote attacker to access sensitive data because UPSMON PRO transmits this data in cleartext over the HTTP protocol. Recommendations: At the moment,...

ALPINE-CVE-2022-45060

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce...

UBUNTU-CVE-2022-45060

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce...

netty: control chars in header names may lead to HTTP request smuggling

A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...

The vulnerability of the Upload component of the software environment for working with Oracle Web Applications desktop integrations allows a hacker to gain full control over the application.

The vulnerability of the Upload component of the Oracle Web Applications Desktop Integrator software lies in insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain full control over the application through the use of the HTTP protocol...