CVE-2022-3260

The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks...

Bypass open redirect protection

Description I could bypass the open redirect protection on the application after parsing the redirect function using the following payload http://[email protected]/ and the payload with the link in the following...

HashiCorp go-getter unsafe downloads

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing...

CVE-2022-26945

The CVE-2022-26945 entry concerns HashiCorp go-getter, where affected versions include up to 1.5.11 and 2.0.2. The root issue is abuse of custom HTTP response header processing that enables protocol switching, endless redirects, and a configuration bypass. Mitigation/fix is available: go-getter 1...

CVE-2022-26945

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0...

CVE-2022-26945

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0...

CVE-2022-26945

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0...

CVE-2022-26945: Undefined Security Weakness

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0...

GHSA-JQM6-M3J3-8GG9 Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

GHSA-JVX9-RJ3W-JQ99 Origin Validation Error in Apache NiFi

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

Authentication Bypass

ngxhttpluamodule is vulnerable to authentication bypass. The vulnerability exists because it doesn't properly restrict the user inputs which allows an attacker to insert unsafe characters in an argument when using the API to mutate a URI, or a request or response header...

CyberArk Identity Security Feature Issue Vulnerability

CyberArk Identity, a CyberArk company, provides the most complete identity security platform to secure all identities from end-to-end.CyberArk Identity is vulnerable to a security signature issue that stems from the fact that the StartAuthentication resource exposes the response header X-CFY-TX-T...

CVE-2022-22700

CyberArk Identity (versions up to 22.1) exposes the response header X-CFY-TX-TM in the StartAuthentication resource. In certain configurations this header contains predictable value ranges that can be used to infer whether a user exists in the tenant. The CVE is CVE-2022-22700; it is a header lea...

PT-2022-28281

Name of the Vulnerable Software and Affected Versions Advanced Rest Client versions prior to 17.0.9 Description The issue allows scripts embedded in a link target to execute any logic that Advanced Rest Client has access to from the renderer process. This includes file system access, data store...

CVE-2022-22700: Use of Insufficiently Random Values

CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant...

CVE-2022-0155

A flaw was found in follow-redirects when fetching a remote URL with a cookie when it gets to the Location response header. This flaw allows an attacker to hijack the account as the cookie is leaked...

IBM Security Verify Information Disclosure Vulnerability (CNVD-2022-03939)

IBM Security VerifyAccess ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT, and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...

CVE-2021-20048

A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service DoS and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions...

CVE-2021-20048: Stack-based Buffer Overflow

A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service DoS and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions...

PT-2021-14754

Name of the Vulnerable Software and Affected Versions ZTE MF971R affected versions not specified Description The issue allows an attacker to modify HTTP response header information through a specially crafted HTTP request, exploiting a CRLF injection vulnerability. Recommendations At the moment,...