CVE-2023-40175 Inconsistent Interpretation of HTTP Requests in puma

Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent ...

HTTP Request Smuggling

aiohttp is vulnerable to HTTP Request Smuggling. The vulnerability occurs due to the use of vulnerable llhttp component. When a specially constructed HTTP request is submitted, it leads to HTTP request smuggling because the server interprets one of the HTTP header values incorrectly. Only aiohttp...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick

auto-cve-2022-44268 Automating expl...

Input validation

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

Jami 输入验证错误漏洞

Jami is an open source, SIP-compatible software telephony and instant messaging software from Jami, Inc. An input validation error vulnerability exists in Jami version 20222284, which stems from incorrect input validation for hyperlink interpretation...

PT-2023-24825 · Microsoft · Windows Qrc Handler

Name of the Vulnerable Software and Affected Versions: Jami version 20222284 Description: The issue is related to improper input validation in hyperlink interpretation. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami...

CVE-2022-48473: Interpretation Conflict

There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal...

CVE-2022-48471: Interpretation Conflict

There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal...

CVE-2023-3001

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2023-1780)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Interpretation Conflict

@openzeppelin/contracts is vulnerable to Interpretation Conflict. The vulnerability exists because the TransparentUpgradeableProxy clashing selector calls may not be delegated if the clashing function has a different signature with incompatible ABI encoding, which could lead to proxy revert while...

PT-2023-35787 · Git +1 · Libheif

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash occurs in the RegionGeometry Polygon::parse function, which is...

CVE-2023-30541: Interpretation Conflict

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

The vulnerability of the drm_gem_shmem_get_sg_table function (drivers/gpu/drm/virtio/virtgpu_object.c) in the Linux kernel allows a hacker to trigger a service failure.

The vulnerability of the drmgemshmemgetsgtable function drivers/gpu/drm/virtio/virtgpuobject.c in the Linux kernel leads to a situation where interpretation conflicts may occur. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the implementation of the IPv6 VPN network protocol on the Cisco IOS XE operating system allows a intruder to cause a service failure.

The vulnerability of the Cisco IOS XE operating system’s IPv6 VPN protocol is related to the occurrence of interpretation conflicts. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions...

The vulnerability of the Aviatrix Controller software, a cloud infrastructure management tool, arises from the existence of interpretation conflicts, allowing an attacker to execute arbitrary code.

The vulnerability of the Aviatrix Controller software management platform for cloud infrastructure is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created file...

CVE-2023-22998: Interpretation Conflict

In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpuobject.c misinterprets the drmgemshmemgetsgtable return value expects it to be NULL in the error case, whereas it is actually an error pointer...

CVE-2022-48261: Interpretation Conflict

There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to be abnormal...

CVE-2022-48230: Interpretation Conflict

There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS...

K27228191: Node.js vulnerability CVE-2018-7159

Security Advisory Description The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the...