37 matches found
OPENSUSE-SU-2023:0370-1 Security update for connman
This update for connman fixes the following issues: - Update to 1.42 Fix issue with iwd and signal strength calculation. Fix issue with iwd and handling service removal. Fix issue with iwd and handling new connections. Fix issue with handling default online check URL. Fix issue with handling...
SUSE CVE-2016-7874
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the NetConnection class when handling the proxy types. Successful exploitation could lead to arbitrary code execution...
OESA-2023-1021 jetty security update
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...
PT-2022-22875 · Proxmox · Proxmox Mail Gateway +1
Name of the Vulnerable Software and Affected Versions: Proxmox Virtual Environment PVE and Proxmox Mail Gateway PMG versions prior to pve-http-server 4.1-3 Description: The issue affects Proxmox Virtual Environment PVE and Proxmox Mail Gateway PMG when proxying HTTP requests between pvepmgproxy a...
PT-2022-4802 · Waitress +5 · Waitress +5
Name of the Vulnerable Software and Affected Versions: Waitress versions 2.1.0 and prior Description: The issue is related to the handling of HTTP requests in Waitress, a Web Server Gateway Interface server for Python 2 and 3. When used behind a proxy that does not properly validate incoming HTTP...
USN-5212-2 apache2 vulnerabilities
USN-5212-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that the Apache HTTP Server incorrectly handled certain forward proxy requests. A remote attacker could use thi...
CVE-2021-32715
hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a Content-Length header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such...
HTTP Smuggling via Transfer-Encoding Header in Puma
Impact This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via...
OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...
OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...
flash-plugin: multiple code execution issues fixed in APSB16-39
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the NetConnection class when handling the proxy types. Successful exploitation could lead to arbitrary code execution...
KLA10825 Multiple vulnerabilities in Microsoft Windows
Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service, gain privileges or obtain sensitive information. Below is a complete list of vulnerabilities 1...
httpd: HTTP request smuggling attack against chunked request parser
Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP...
Protection against Mozilla Firefox SSL Tampering via non-200 Responses to Proxy CONNECT Requests
Mozilla Firefox, Thunderbird and SeaMonkey use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server. A vulnerability was reported in Mozilla Firefox, a feely available Web browser. The vulnerability resides in the handling of non-2...
Apache Tomcat 5.x < 5.5.22 / 6.0.x < 6.0.10 Directory Traversal Arbitrary File Access
Binary data 3949.pasl...
