CVE-2021-40346

CVE-2021-40346: HAProxy HTTP Request Smuggling - ACL Bypass نظرة عامة يُظهر هذا المشروع CVE-2021-40346 ، وهي ثغرة حرجة في تجاوز عدد صحيح في HAProxy تُمكن من هجمات تهريب طلبات HTTP لتجاوز ضوابط الأمان. درجة CVSSv3: 7.5 عالية المساهمون: 1. بويتان إدوارد 2. بورسوش ماتياس رولاند ما هو CVE-2021-40346؟...

SAPGateBreaker-Exploit

CVE-2022-22536: تهريب طلبات HTTP عبر الباب الأمامي لـ SAP خوادم تطبيقات SAP NetWeaver ABAP، وخوادم تطبيقات SAP NetWeaver Java، ومنصة ABAP، وخادم المحتوى SAP 7.53، وموزع الويب SAP معرضة لخطر تهريب الطلبات ودمجها. يمكن للمهاجم غير الموثق إضافة بيانات عشوائية في بداية طلب الضحية. بهذه الطريقة، يمكن...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path,...

CVE-2020-25613

POC POST / HTTP/1.1 Host: 127.0.0.1:1080 Content-Type: text/html Content-Length: 129 Connection: keep-alive Transfer-Encoding: 0xb chunked 1 A 0 POST /flag HTTP/1.1 Host: 127.0.0.1:1080 Content-Length: 180 Connection: keep-alive Content-Type: text/html URI:...

CVE-2021-40346

CVE-2021-40346 — تجاوز عدد صحيح في HAProxy يؤدي إلى تهريب طلبات HTTP ملخص الثغرة HAProxy هو برنامج وكيل عكسي وموزّع أحمال مفتوح المصدر، يتولى توزيع الأحمال ومعالجة قواعد التحكم في الوصول ACL وغيرها CVE-2021-40346 هي ثغرة تجاوز قواعد التحكم في الوصول ACL Bypass تنشأ في الدالة htxaddheader التي يخز...

jetty-line-check

jetty-line-check Which of these six 2026 CVEs has your Jetty or the Jetty pulled in by Spring Boot been hit by — and does the version the official guidance tells you to upgrade to actually exist on Maven Central? The headline is CVE-2026-2332 GHSA-355h-qmc2-wpwf, high / CVSS v3 7.4: chunked reque...

CVE-2023-25690_lab

تهريب طلبات HTTP عبر وكيل Apache إعداد البيئة البنية التحتية المكوّن| الدور| الإصدار ---|---|--- خادم Apache HTTP| وكيل عكسي| 2.4.55 قابل للاستغلال Spring Boot Tomcat مدمج| واجهة برمجة التطبيقات الخلفية| 4.x Java 21 SQLite| قاعدة البيانات| — المستخدم ──► Apache :80 الوكيل ──► Spring Boot :8080...

Security Bulletin: Due to the use of HTTP/1.1 with Jetty server, IBM Sterling Control Center is vulnerable to Inconsistent Interpretation of HTTP Requests (CVE-2026-19203)

Summary HTTP/1.1 with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary...

CVE-2019-20372

مرجع https://bertjwregeer.keybase.pub/2019-12-10%20-%20errorpage%20request%20smuggling.pdf تشغيل الخادم docker run -it --rm -p 80:80 -v pwd/default.conf:/etc/nginx/conf.d/default.conf nginx:1.17.6 الاستغلال printf "GET /a HTTP/1.1\r\nHost: localhost\r\nContent-Length: 56\r\n\r\nGET...

NetScaler 73.30 HTTP Request Smuggling

NetScaler version 73.30 contains an HTTP/1.1 chunk-size accumulator overflow that can cause request parsing desynchronization and request smuggling...

F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit

F5 BIG-IP CVE-2023-46747 – ثغرة RCE بدون مصادقة + قشرة عكسية إصدارا Python3 وNuclei – بواسطة raguraman ثغرة RCE حرجة بدون مصادقة CVSS 9.8 عبر AJP وتهريب طلبات HTTP تعمل على جميع إصدارات BIG-IP غير المُصحّحة 13.x → 17.x بما في ذلك الأحدث 17.1.0.3 التصحيح:...

Security Bulletin: Vulnerability in aiohttp bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the aiohttp library, which is affected by multiple vulnerabilities, including HTTP request smuggling and out-of-bounds read vulnerabilities. CVE-2026-69243, CVE-2026-69244. Vulnerability Details CVEID:CVE-2026-69243...

SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2026:4403-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4403-1 advisory. - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsin...

SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:4404-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4404-1 advisory. - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsin...

CVE-2026-66357

A flaw was found in the inets component of Erlang/OTP, specifically within its httpd server. This vulnerability arises from the httpd server's failure to correctly implement obs-fold obsolete line folding for HTTP header continuation lines, as defined in RFC 2616 and RFC 7230. This oversight allo...

sanic chunked trailer request smuggling allows hidden second request execution

DescriptionSanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

PYSEC-2026-4162 sanic chunked trailer request smuggling allows hidden second request execution

Description Sanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-10841 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling. CWE:CWE-444: Inconsistent...

Security Bulletin: Due to use of WebSphere Application Server - Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

Rocky Linux 8 [CIQ] Security Update: varnish / varnish-devel / varnish-docs / varnish-modules / etc (crlsa-2021_2988)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212988 advisory. varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request CVE-2021-36740 Tenable has extracted the preceding description block...