squid: Header Smuggling issue in HTTP Request processing

An input validation flaw was found in Squid's mimegetheaderfield function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid...

squid: Cache poisoning issue in HTTP Request handling

An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid...

The vulnerability of the PHP interpreter allows attackers to trigger a service failure or execute arbitrary code.

The vulnerability of the mget function in the Fileinfo component of the PHP interpreter exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause a service failure application termination or execute arbitrary code using a specially created...

The vulnerability of the PHP interpreter allows attackers to execute arbitrary code.

The vulnerability of the splptrheapinsert function ext/spl/splheap.c in the PHP interpreter is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by invoking the faulty operation of SplMinHeap::compare...

PHP Double Release Vulnerability

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language supports multiple syntaxes, multiple databases and operating systems, and support for C, C++ for program extensions and so on. A...

Apple iOS/watchOS and OS X El Capitan MapKit Sensitive Information Disclosure Vulnerability

Apple iOS is an operating system on Apple's cell phones. oS X El Capitan is a specialized operating system developed for Mac computers. watchOS is a smartwatch operating system. Apple iOS\watchOS and OS X El Capitan's MapKit fails to properly handle HTTP and HTTPS requests, allowing an attacker t...

UBUNTU-CVE-2015-8873

Stack consumption vulnerability in Zend/zendexceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service segmentation fault via recursive method calls...

The vulnerability of the Windows operating system, which allows a perpetrator to trigger a service failure

The vulnerability of the HTTP.sys component in the Windows operating system is related to improper data processing. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause a service failure system shutdown through specially crafted HTTP 2.0 requests...

PHP integer overflow vulnerability (CNVD-2016-02715)

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. An integer overflow vulnerability exists in PHP, which can be exploited by remote attackers to cause a denial of service crash...

Microsoft Windows HTTP.sys Denial of Service Vulnerability

Microsoft Windows 10 is a set of next-generation cross-platform operating systems released by the U.S.-based Microsoft Corporation Microsoft for PCs and laptops, tablets, and cell phones, among other devices. A denial of service vulnerability exists in the HTTP 2.0 protocol stack HTTP.sys in...

The vulnerability of the PHP interpreter, which allows attackers to trigger a service failure or exert other effects.

The vulnerability of the wddx.c function in the PHP WDDX interpreter is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause service failure or potentially other effects, such as memory corruption or the termination of the application,...

EAP: HTTPS NIO connector uses no timeout when reading SSL handshake from client

A read-timeout flaw was found in the HTTPS NIO Connector handling of SSL handshakes. A remote, unauthenticated attacker could create a socket and cause a thread to remain occupied indefinitely so long as the socket remained open denial of service...

The vulnerability of the Thunderbird email client, as well as the Firefox and Firefox ESR browsers, allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the nsScannerString::AppendUnicodeTo function in Thunderbird email clients, as well as in Firefox and Firefox ESR browsers, arises due to buffer overflows. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure memory exhaustion ...

The vulnerability of the Business Process Manager system allows a perpetrator to inject arbitrary Web or HTML code.

The vulnerability of the Document List control implementation in the Business Process Manager system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially crafted URL...

The vulnerabilities in the Moodle learning management system allow a hacker to inject arbitrary Web or HTML code.

The multiple vulnerabilities of the Moodle learning management system’s SCORM module exist due to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities allows a malicious actor to inject arbitrary Web or HTML code using a specially created name for the...

Vulnerabilities in the software for Cisco WebEx Meetings Server, which allow attackers to inject arbitrary Web or HTML code

Multiple vulnerabilities in the software for Cisco WebEx Meetings Server exist due to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities allows a malicious actor to inject arbitrary Web or HTML code remotely...

The vulnerability of the Adobe Connect instant messaging program allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the Adobe Connect instant messaging program exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...

The vulnerability of the Adobe Connect instant messaging program allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the Adobe Connect instant messaging program exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using request parameters...

The vulnerability of Microsoft Excel editors allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of Microsoft Excel editors exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code through a specially crafted email message...

chromium-browser: use-after-free in Blink

WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via a crafted HTML document...