5603 matches found
Libsoup: improper handling of http vary header in libsoup caching
...
shellshocker-pocs
This is a collection of Proof of Concepts PoCs and potential targets for the ShellShocker vulnerability. The PoCs are designed to exploit the vulnerability in various products and services, including XMPP ejabberd, Mailman, MySQL, NFS, Bind9, FTP, and others. The PoCs are primarily focused on...
OESA-2025-2166 lighttpd security update
Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more...
Linux Distros Unpatched Vulnerability : CVE-2025-9901
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup's caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : KMail Account Wizard vulnerability (USN-7732-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7732-1 advisory. It was discovered that KMail Account Wizard used HTTP rather than HTTPS when retrieving certain email server configurations. A...
CVE-2024-12973
Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from s1.09.01 before v1.11.01...
Errors returned from JSON marshaling may break template escaping in html/template
...
Improper handling of empty HTML attributes in html/template
...
Excessive resource consumption in net/http, net/textproto and mime/multipart
...
Improper handling of HTML-like comments in script contexts in html/template
...
Denial of service due to improper 100-continue handling in net/http
...
CVE-2025-58056
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters LF as a chunk-size line...
CVE-2025-9867
Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
CVE-2025-9865
In Google Chrome on Android (versions prior to 140.0.7339.80 ), an inappropriate implementation in the Toolbar component allows a remote attacker to perform domain spoofing . The attacker must first convince a user to engage in specific UI gestures while visiting a crafted HTML page. This vulnera...
PT-2025-35742
Name of the Vulnerable Software and Affected Versions: BuddyDev MediaPress versions through 1.5.9.1 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue, which allows for PHP Local File Inclusion...
CVE-2025-9800 SimStudioAI sim HTML File route.ts import unrestricted upload
A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file apps/sim/app/api/files/upload/route.ts of the component HTML File Parser. Executing manipulation of the argument File can lead to unrestricte...
CLSA-2025-1756751597 squid: Fix of CVE-2023-46846
CVE-2023-46846: fix Request/Response chunk smuggling in HTTP/1.1 and ICAP...
The vulnerability of the WEBrick HTTP-server’s toolset, related to HTTP request processing flaws, allows attackers to execute the “HTTP request hijacking” attack.
The vulnerability of the WEBrick HTTP-server’s tools is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to carry out an “HTTP request hijacking” attack...
Linux Distros Unpatched Vulnerability : CVE-2025-8671
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may...