Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the handling of incoming HTTP requests with Transfer-Encoding: chunked or without a Content-Length header. An attacker can cause uncontrolled memory allocation on the server b...

DEBIAN-CVE-2025-46728

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or when no Content-Length header is provided. A remote attacker can send a chunked...

CVE-2025-27912

An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when 1 Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or 2 when username/password or Active Directory authentication is in use and a...

CVE-2025-27912: Cross-Site Request Forgery (CSRF)

An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when 1 Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or 2 when username/password or Active Directory authentication is in use and a...

GHSA-C4PW-33H3-35XW Atro CSRF Middleware Bypass (security.checkOrigin)

Summary A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. Details When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. Source code:...

CVE-2024-10086

A flaw was found in Consul and Consul Enterprise. This vulnerability allows reflected Cross-site scripting XSS attacks via missing Content-Type HTTP header in server responses, enabling misinterpretation of user-provided inputs. Mitigation Mitigation for this issue is either not available or the...

CVE-2023-4819: Undefined Security Weakness

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts...

SAP Enable Now 跨站脚本漏洞

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for online learning and training in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now that stems from an unimplemented...

The vulnerability of the ABB eSOMS software for managing production processes allows a hacker to execute arbitrary code.

The vulnerability of the ABB eSOMS software for managing production processes is related to the absence of the X-Content-Type-Options Header in the HTTP response. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2022-2547

A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22...

CVE-2020-26154: Buffer Copy without Checking Size of Input

url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header...

CVE-2019-17502

Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The processheaderend function calls boaatoi, which ultimately calls atoi on a NULL pointer...

DEBIAN-CVE-2016-6801

Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...

UBUNTU-CVE-2016-6801

Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...

WengoPhone 2.x - SIP Phone Remote Denial of Service

/main.cpp/ include include using namespace std; ifdef WIN32 include pragma commentlib, "ws232.lib" define close closesocket define writea,b,c senda, b, c, 0 define writetoa,b,c,d,e sendtoa, b, c, 0, d, e define reada,b,c recva, b, c, 0 define readfroma,b,c,d,e recvfroma, b, c, 0, d, e else includ...

CVE-2007-1406: Undefined Security Weakness

Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors...

CVE-2002-1077: Undefined Security Weakness

IPSwitch IMail Web Calendaring service iwebcal allows remote attackers to cause a denial of service crash via an HTTP POST request without a Content-Length field...