648 matches found
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp, python-time-machine (SUSE-SU-2024:0577-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0577-1 advisory. python-aiohttp was updated to version 3.9.3: Fixed backwards compatibility breakage in 3.9.2 of...
IBM PowerSC Explains Conflict Vulnerabilities
IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC suffers from an interpretation conflict vulnerability that stems from not using a secure HTTP method, which could be exploited by an attacker to perform unauthorized...
The vulnerability of the Apache Tomcat application server, related to the inconsistent interpretation of HTTP requests, allows attackers to compromise the integrity of the protected information.
The vulnerability of the Apache Tomcat application server is related to the inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...
The vulnerability of the twisted.web network framework’s component, which allows a hacker to compromise the integrity of the protected information.
The vulnerability of the twisted.web network framework’s component is related to inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a remote attacker to compromise the integrity of protected information through multiple HTTP requests...
Denial Of Service (DoS)
Open Policy Agent is vulnerable to Denial Of Service DoS. The vulnerability is due to ast/parser.go which incorrectly interprets expression. This results in triggering out of range memory access, resulting in Denial of Service DoS...
Design/Logic Flaw
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...
Interpretation Conflict
bref/bref is vulnerable to Interpretation Conflict. The vulnerability is caused by the mishandling of headers due to the server only returning the last header if multiple headers are included in a request. If the application relies on multiple headers with the same key being set for security...
IBM PowerSC 安全漏洞
IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC suffers from an interpretation conflict vulnerability that stems from not using a secure HTTP method, which could be exploited by an attacker to perform unauthorized...
The vulnerability of the Netty network programming framework arises from the existence of interpretation conflicts, which allow attackers to disclose and modify protected information.
The vulnerability of the Netty network programming framework is related to the occurrence of interpretation conflicts. Exploiting this vulnerability can allow a remote attacker to disclose and modify the protected information...
Mozilla: Truncated signed text was shown with a valid OpenPGP signature
The Mozilla Foundation Security Advisory: When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header...
Mozilla: Truncated signed text was shown with a valid OpenPGP signature
The Mozilla Foundation Security Advisory: When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header...
The vulnerability in the isolated iframe environment of Mozilla Firefox allows a perpetrator to circumvent existing security restrictions.
The vulnerability in the isolated iframe environment of Mozilla Firefox is related to data interpretation errors. Exploiting this vulnerability can allow a remote attacker to bypass existing security restrictions...
SUSE-SU-2023:4909-1 Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: - CVE-2023-47641: Fixed inconsistent interpretation of the http protocol, if content-length and transport-encoding are in the same header with transport-encoding value of 'chunked' bsc1217174...
CVE-2023-40716
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup...
Open redirect
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...
PYSEC-2023-247
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
Impact Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-LengthCL and Transfer-EncodingTE it can lead to incorrect interpretation of two entities that parse the HTTP and we can poiso...
The vulnerability of the Suricata intrusion detection and prevention system, related to the occurrence of interpretation conflicts, allows an intruder to bypass or neutralize any signature based on the TCP protocol.
The vulnerability of the Suricata intrusion detection and prevention system is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a remote attacker to bypass or neutralize any TCP-based signature, by intercepting the TCP segment...
The vulnerability of software for scanning and controlling IPS engine applications in FortiOS systems arises from interpretational conflicts, allowing attackers to circumvent existing security restrictions.
The vulnerability of software for scanning and controlling IPS engine applications in FortiOS systems is related to the occurrence of interpretation conflicts. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions remotely...