UBUNTU-CVE-2014-10375

handlemessages in eXtltls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header...

CVE-2014-10375

CVE-2014-10375 concerns eXosip’s handling of TLS messages in the eXtl_tls.c module (pre-5.0.0) where a negative value in a Content-Length header is mishandled. The vulnerability originates from the content-length parsing logic in handle_messages, enabling malformed TLS headers to affect eXosip pr...

ALPINE-CVE-2019-9516

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory fo...

Moderate: Red Hat Security Advisory: http-parser security update

An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

如何针对使用HTTP的.NET Remoting finding and using deserialization vulnerability-vulnerability warning-the black bar safety net

One, overview In the NCC Group and most recent safety assessment, 我发现了一个.NET v2. 0 app, 该应用程序使用.NET Remoting by HTTP to send the SOAP request to the other server to communicate. In the application of the anti-compiled, I realized that the server has TypeFilterLevel is set to Full, this is very...

UBUNTU-CVE-2019-7733

In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove...

Request-smuggling Attacks

Apache Tomcat Coyote before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, doesn't handle inconsistent HTTP request headers well when an HTTP or AJP connector is used. This allows remote attackers to incorrectly identify the requests length and conduct request-smuggling attacks through...

Denial Of Service (DoS)

Jetty HTTP Server is vulnerable to denial of service. HTTP requests are not properly validated, which allows for a remote attacker to cause the application to crash via a large value in the Content-Length header...

Foscam Opticam i5 Denial of Service Vulnerability (CNVD-2018-22817)

Foscam Opticam i5 is an IP camera from FOSCAM. A denial of service vulnerability exists in RtspServer in the Foscam Opticam i5 with system firmware 1.5.2.11 and application firmware 2.21.1.128. A remote attacker can exploit this vulnerability to cause a denial of service daemon hang or restart vi...

CVE-2018-19077

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. RtspServer allows remote attackers to cause a denial of service daemon hang or restart via a negative integer in the RTSP Content-Length header...

Node.js Improper Input Validation Vulnerability (Mar 2018) - Mac OS X

Node.js is prone to an improper input validation vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js";...

UBUNTU-CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x all non HTTP/1.x configurations, and 9.4.x all HTTP/1.x configurations, when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was...

ALPINE-CVE-2018-7159

The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been...

CVE-2018-7159

The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been...

CVE-2018-7159

The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been...

SUSE-SU-2018:0952-1 Security update for nodejs4

This update for nodejs4 fixes the following issues: - Fix some node-gyp permissions - New upstream maintenance 4.9.1: Security fixes: + CVE-2018-7158: Fix for 'path' module regular expression denial of service bsc1087459 + CVE-2018-7159: Reject spaces in HTTP Content-Length header values bsc10874...

The vulnerability of the Jakarta Multipart parser on the Apache Struts software platform allows a hacker to execute arbitrary code.

The vulnerability of the Jakarta Multipart parser on the Apache Struts software platform arises from insufficient checks of the values of Content-Type, Content-Disposition, and Content-Length headers. This allows attackers to execute commands on the target system...

Nextcloud Quota Limit Bypass Vulnerability

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Server is one of the server version. A security vulnerability exists in Nextcloud Server versions prior to 9.0.55 and prior to 10.0.2, which stems from the...

PT-2017-10688 · Nextcloud · Nextcloud Server

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 9.0.55 Nextcloud Server versions prior to 10.0.2 Description: The issue allows an authenticated adversary to bypass quota limitations due to improper sanitization of the OC-Total-Length HTTP header values...

Design/Logic Flaw

In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack methodology involves a long Host header and an invalid Content-Length header...