Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks

Impact Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-LengthCL and Transfer-EncodingTE it can lead to incorrect interpretation of two entities that parse the HTTP and we can poiso...

The vulnerability of the Suricata intrusion detection and prevention system, related to the occurrence of interpretation conflicts, allows an intruder to bypass or neutralize any signature based on the TCP protocol.

The vulnerability of the Suricata intrusion detection and prevention system is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a remote attacker to bypass or neutralize any TCP-based signature, by intercepting the TCP segment...

The vulnerability of software for scanning and controlling IPS engine applications in FortiOS systems arises from interpretational conflicts, allowing attackers to circumvent existing security restrictions.

The vulnerability of software for scanning and controlling IPS engine applications in FortiOS systems is related to the occurrence of interpretation conflicts. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions remotely...

CVE-2023-40718

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

CVE-2023-40718

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

Input validation

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

CVE-2023-40718

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

CVE-2023-40718

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

Fortinet FortiOS IPS Engine Security Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering, and antispam security features. A security vulnerability exists in the...

PT-2023-6016 · Fortinet · Fortinet Ips Engine +1

Name of the Vulnerable Software and Affected Versions: Fortinet IPS Engine versions 6.158, 7.166, 7.321 Description: The issue is related to an interpretation conflict in the Fortinet IPS Engine, which can be exploited by an attacker to evade IPS features. This can be achieved via crafted TCP...

IPS Engine evasion using custom TCP flags

...

CVE-2023-40718: Interpretation Conflict

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

CVE-2023-30910

HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests...

CVE-2023-30910: Inconsistent Interpretation of HTTP Requests

HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests...

The vulnerability in the function for protecting group IP traffic in the GET VPN implementation, based on the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols, allows a attacker to execute arbitrary code, cause service failures, or gain full control over the application.

The vulnerability in the function for protecting group IP traffic in the GET VPN implementation of the Group Domain of Interpretation GDOI and G-IKEv2 protocols on Cisco IOS and IOS XE operating systems stems from the operation of operations beyond the buffer in memory when processing protocol...

CVE-2023-20109

A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause...

Cisco IOS and IOS XE Software Cisco Group Encrypted Transport VPN Software Out-of-Bounds Write Vulnerability

A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause...

PT-2023-5691

Name of the Vulnerable Software and Affected Versions: Cisco IOS and IOS XE Software affected versions not specified Description: A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacke...

CVE-2023-4809 pf incorrectly handles multiple IPv6 fragment headers

In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a...

CVE-2023-40175

An HTTP request smuggling attack vulnerability was found in Rubygem Puma. This flaw allows an attacker to gain unauthorized access to sensitive data due to an inconsistent interpretation of HTTP requests...