5604 matches found
tomcat: Improper Handling of Exceptional Conditions
A vulnerability was found in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This issue led to a miscounting of active HTTP/2 streams, which in turn led to using an incorrect infinite timeout that allowed connections to remain...
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2024-2245)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS Virtualization 2.11.1 : nghttp2 (EulerOS-SA-2024-2171)
According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps...
curl: HTTP/2 push headers memory-leak
A flaw was found in curl. When an application configures libcurl to use HTTP/2 server push and the amount of received headers for the push surpasses the maximum allowed limit, libcurl aborts the server push. When aborting, libcurl does not free all the previously allocated headers, resulting in a...
twisted.web has disordered HTTP pipeline response
...
HTML injection in HTTP redirect body
...
An issue was discovered in HTTP2 in Qt before 5.15.18 6.x before 6.2.13 6.3.x through 6.5.x before 6.5.7 and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early because the encrypted() signal has not yet been emitted and processed..
...
PT-2024-41074 · Ооо 'Нпо Мир' · Контроллер Мир Кт-51 +3
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to the implementation of the HTTP protocol in software products, which involves the transmission of data in an open format. This could allow a remote attacker to disclos...
OESA-2024-1983 python-twisted security update
Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1...
The vulnerability of the administrative interface of the FortiADC application controller allows a perpetrator to gain access to write arbitrary files.
The vulnerability of the FortiADC application delivery controller’s administrative interface is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain write access to arbitrary files by sending specially crafted HTTP or HTTPS requests...
The vulnerability of the user interface of the Oracle ZFS Storage Appliance Kit allows a intruder to gain unauthorized access to protected information.
The vulnerability of the Oracle ZFS Storage Appliance Kit’s user interface is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using the HTTP network protocol...
CVE-2024-38501
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device...
mIPC camera 安全漏洞
mIPC camera is a series of cameras from mIPC. A security vulnerability exists in versions prior to mIPC camera v5.4.1.240424171021, which stems from an operating system command injection flaw in the ccmdebug component that allows an attacker on the same network to execute arbitrary code via a...
The vulnerability of the WebTransport interface in Google Chrome and Microsoft Edge allows a hacker to execute arbitrary code.
The vulnerability of the WebTransport interface in Google Chrome and Microsoft Edge relates to memory-walking attacks. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created HTML page...
httpd: CONTINUATION frames DoS
A vulnerability was found in how Apache httpd implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers,...
Spring Tips: HTMX
Hi, Spring fans! HTMX is the progressive hypertext sensation that's sweeping the process of web app creation, and - thanks to a nice integration by Spring community legend Wim Deblauwe, it's easier than ever to use it with Spring Boot and Thymeleaf. And, it's the topic of today's installment! jav...
Cisco Small Business SPA300 Series IP Phones和Cisco Small Business SPA500 Series IP Phones 安全漏洞
Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA300 Series IP Phones are both products of Cisco, Inc.Cisco Small Business SPA500 Series IP Phones are an SPA500 Series IP Phone. The Cisco Small Business SPA500 Series IP Phones are SPA500 Series IP Phones.The Cisco Small...
DEBIAN-CVE-2024-6999
Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
DEBIAN-CVE-2024-6989
Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...