CVE-2024-50340

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

The vulnerability of the password-changing function of the Cisco Firepower Management Center (FMC) software interface allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the password-changing function in the Cisco Firepower Management Center FMC software for network administration involves errors in handling requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2024-49768

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

Cross-site Request Forgery (CSRF) Bypass

hono is vulnerable to Cross-site Request Forgery CSRF Bypass. The vulnerability is due to Hono treating requests without a Content-Type header as safe, allowing attackers to bypass CSRF protection...

HTTP Smuggling

org.jboss.resteasy, resteasy-netty4-cdi is vulnerable to HTTP Smuggling. The vulnerability is due to improper handling of HTTP requests by the resteasy-netty4 library, specifically when the Netty HttpObjectDecoder fails to process HTTP smuggling requests with ASCII control characters, causing it ...

PT-2024-23194 · Hcl · Hcl Connections

Name of the Vulnerable Software and Affected Versions: HCL Connections affected versions not specified Description: The issue is related to an information disclosure vulnerability. It could allow a user to obtain sensitive information they are not entitled to because of improperly handling the...

The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma, which allows attackers to induce a service failure.

The vulnerability of HTTP servers for Ruby/Rack applications related to HTTP request processing flaws. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma allows attackers to execute arbitrary code.

The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma is related to improper handling of HTTP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Loway QueueMetrics software for analyzing call center efficiency metrics lies in its lack of proper HTTP request processing capabilities. This allows attackers to circumvent existing security restrictions.

The vulnerability of the Loway QueueMetrics performance analysis software relates to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and carry out an “HTTP request hijacking” attack...

ROS-20241001-03

An HTTP server vulnerability for Ruby/Rack application Puma is related to a flaw in HTTP request handling. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service using a specially crafted HTTP request HTTP Request Smuggling attack The HTTP server...

CVE-2024-47220

A flaw was found in the webrick toolkit. This issue occurs because the server incorrectly handles requests with both Content-Length and Transfer-Encoding headers. This can allow an attacker to sneak in an extra request such as GET /admin after the normal request POST /user. As a result,...

MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service', 'Description' = %q This module will check if scanned hosts are vulnerable to...

The vulnerability of the twisted.web network framework’s component, which allows a hacker to disclose protected information

The vulnerability of the twisted.web network framework’s component is related to improper handling of HTTP requests. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the framework...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: iouring: drop any code related to SCMRIGHTS CVE-2023-52656 Integer Overflow or Wraparound vulnerability in Linux kernel on x86 and ARM md, raid, raid5 modules allows Forced Integer Overflow. CVE-2024-23307 A...

PT-2024-6830 · Sap · Sap Crm Abap

Name of the Vulnerable Software and Affected Versions: SAP CRM ABAP affected versions not specified Description: The issue is related to insufficient checking of incoming HTTP requests in the Insights Management component of the SAP CRM ABAP integration module. This can allow a remote attacker to...

PT-2024-27769 · Vercot · Serva

Name of the Vulnerable Software and Affected Versions: vercot Serva version 4.6.0 Description: A NULL pointer dereference in vercot Serva allows attackers to cause a Denial of Service DoS via a crafted HTTP request. Recommendations: For version 4.6.0, consider disabling the HTTP request handling...

Exploit for Code Injection in Geoserver

CVE-2024-36401-PoC This repository contains a Proof of Conce...

CVE-2024-42152

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmetsqdestroy we capture sq-ctrl early and if it is non-NULL we know that a ctrl was allocated in the admin connect request handler and we need to release...

The vulnerability of the GLPI system’s request and incident handling functionality lies in the lack of HTML tag neutralization during website generation. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the GLPI system’s request and incident handling functionality relates to the absence of HTML tag neutralization during the generation of web pages. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks...

The vulnerability of the GLPI system’s request and incident handling capabilities, related to improper management of privileges, allows a perpetrator to disclose protected information.

The vulnerability of the GLPI system for handling requests and incidents is related to improper management of privileges. Exploiting this vulnerability can allow a malicious actor to disclose protected information...