OESA-2023-1365 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code Security Fixes: Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the...

The vulnerability of the libcurl library, related to errors in sending HTTP POST and PUT requests using the same descriptor, allows an attacker to gain unauthorized access to protected information.

The vulnerability of the libcurl library is related to errors during the sending of HTTP requests using POST and PUT methods, where the same descriptor is used. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

FreeBSD : curl -- multiple vulnerabilities (a4f8bb03-f52f-11ed-9859-080027083a05)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a4f8bb03-f52f-11ed-9859-080027083a05 advisory. - The vulnerability exists due to a use-after-free error when checking the SSH sha256...

SUSE CVE-2017-12617

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted...

The vulnerability of the cURL command-line utility arises from a logical error in the reused descriptor, which allows a hacker to trigger a service failure or cause other adverse effects on the system when processing subsequent HTTP requests like PUT and POST.

The vulnerability of the command-line tool cURL is related to a logical error in the reused descriptor during the processing of subsequent HTTP requests like PUT and POST. Exploiting this vulnerability can allow an attacker to cause service failures or other adverse effects on the system by using...

The vulnerability of the httpd daemon in FortiOS operating systems and the proxy server designed to protect against Internet attacks by FortiProxy allows a perpetrator to cause a service failure.

The vulnerability of the httpd daemon in FortiOS operating systems, as well as the proxy server used for protecting against Internet attacks via FortiProxy, is related to writing data beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service...

Threat Advisory: CVE-2022-40684 Fortinet Appliance Auth bypass

This morning, the Wordfence Threat Intelligence team began tracking exploit attempts targeting CVE-2022-40684 on our network of over 4 million protected websites. CVE-2022-40684 is a critical authentication bypass vulnerability in the administrative interface of Fortinet’s FortiGate firewalls,...

GHSA-XJGH-84HX-56C5 Unrestricted Upload of File with Dangerous Type Apache Tomcat

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted...

CVE-2021-21876

Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

CVE-2021-21876

Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

Design/Logic Flaw

Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

CVE-2021-21876

Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

CVE-2021-21876

CVE-2021-21876 affects Lantronix PremierWave 2050 Web Manager. Vulnerable due to OS command injection in the FsTFtp handling of authenticated HTTP requests (PUT/GET). The vulnerability arises when user-supplied parameters (cwd, local, remote, host, port, etc.) are assembled into a system call wit...

CVE-2021-43807

Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE...

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

Code injection

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

UBUNTU-CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...