CVE-2020-35391-POC

CVE-2020-35391-POC에 오신 것을 환영합니다 👋 Tenda N300 변조된 HTTP 요청 헤더를 통한 인증 우회 Python PoC Tenda N300 F3 12.01.01.48 장치는 cgi-bin/DownloadCfg/RouterCfm.cfg에 대한 직접 요청을 통해 원격 공격자가 민감한 정보아마도 httppasswd 라인 포함를 얻을 수 있도록 허용합니다. 이는 CVE-2017-14942와 관련된 문제입니다. 참고: 취약점 보고서는 RouterCfm.cfg 파일 이름 뒤에 ? 문자를 배치하거나 HTTP 요청...

CVE-2017-12542-Exploit

HP iLO 인증 우회 CVE-2017-12542 이 저장소는 HP Integrated Lights-Out iLO 펌웨어의 특정 버전에 영향을 미치는 인증 우회 취약점인 CVE-2017-12542 에 대한 개념 증명 익스플로잇 을 포함하고 있습니다. 이 취약점은 인증되지 않은 접근으로 iLO REST API에 접근할 수 있게 하며, 이를 악용하여 계정을 열거하고 취약한 구성에서 새로운 관리자 사용자를 생성할 수 있습니다. 취약점 개요 CVE : CVE-2017-12542 영향을 받는 제품 : HP iLO 여러 세대 영향 : 인...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.2:CLSA-2026:1784191279)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784191279 advisory. - The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed...

CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663

Netty's HTTP/3 codec (io.netty:netty-codec-http3 ) versions 4.2.2.Final through 4.2.17.Final are vulnerable to a request smuggling or bypass issue in HttpConversionUtil.toHttp3Headers. The root cause is the failure to special-case HTTP/1 CONNECT authority-form request-targets during HTTP/1-to-HTT...

CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

SUSE CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

UBUNTU-CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78222 NGINX ngx_http_js_module vulnerability

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

PT-2026-84763

Name of the Vulnerable Software and Affected Versions NGINX JavaScript affected versions not specified Description A flaw in NGINX JavaScript allows a remote attacker to cause a denial-of-service DoS on the system. The issue occurs when the ngx.fetch function receives a malformed HTTP response an...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252: Out-of-bounds Write

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...