319 matches found
GetGo Download Manager 5.3.0.2712 - Buffer Overflow
GetGo Download Manager 5.3.0.2712 - Buffer Overflow Exploit Title: Buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 CVE: CVE-2017-17849 Date: 22-12-2017 Tested on Windows 10 32 bits Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Software Link:...
GetGo Download Manager 5.3.0.2712 Buffer Overflow
Exploit Title: Buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 CVE: CVE-2017-17849 Date: 22-12-2017 Tested on Windows 10 32 bits Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Software Link: http://www.getgosoft.com/getgodm/ Category: webapps Attack...
EAP7: Internal IP address disclosed on redirect when request header Host field is not set
It was found that when issuing a GET request which results in a 302 redirect, and when the request header 'Host' field was not set, the response header field 'Location' contains the internal IP address of the server. An attacker could use this disclose information which they are not authorized to...
Apache Optionsbleed Scanner
This module scans for the Apache optionsbleed vulnerability where the Allow response header returned from an OPTIONS request may bleed memory if the server has a .htaccess file with an invalid Limit method defined. Module Options msf use auxiliary/scanner/http/apache/optionsbleed msf...
WakaTime: Sensitive Cookie Without 'HttpOnly' Flag
hello wakatime security team i found security vulnerability:Sensitive Cookie Without 'HttpOnly' Flag when i was testing your website then i notice that there is some csrftoken cookie appare in responce but the cookie have not httponly flag.you must should set httponly flag for some following...
CVE-2017-7679
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, modmime can read one byte past the end of a buffer when sending a malicious Content-Type response header...
Design/Logic Flaw
Web Server method disclosure in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote attackers to exploit and find another hole via HTTP response header...
CVE-2017-4015
Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header...
CVE-2017-4013
Banner Disclosure in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote attackers to obtain product information via HTTP response header...
CVE-2017-4016
CVE-2017-4016 affects McAfee Network Data Loss Prevention (NDLP) 9.3.x. The Web server allows information disclosure through HTTP response headers, enabling remote attackers to reveal additional vulnerabilities via the header leakage. CVSS data indicates network access with low privileges and par...
CVE-2017-4016
Web Server method disclosure in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote attackers to exploit and find another hole via HTTP response header...
Preventing the Cache-Control Response Header from being Set to private
Q: When Compression is enabled on a NetScaler appliance, can you prevent the Cache-Control response header being set to the value private? A: Yes. You can prevent the Cache-Control response from being set to the value private when compression is enabled on a NetScaler appliance. To prevent the...
Mail.ru: CRLF инъекция на https://tz.mail.ru
HTTP response header CRLF injection via GET parameters in tz.mail.ru. tz.mail.ru is not currently in the Bug bounty scope...
Nextcloud: Bad content-type in response header when getting document can lead to html injection
Bug When request document by genesisid or filename, the content-type field in response header is 'text/html'. And the document content can be anything. So if we upload an odt file with html format and share with other users, it can lead to html injection when others request that file. PoC - img1...
Uber: Server version disclosure
Hi uber, maybe this is a low risk but i want to report that the nginx and openresty server version are being disclosed. For openresty: Accessing this url: https://chef.uberinternal.com/ will give you an error "502 Bad Gateway" but you can see on the page that the server version was disclose...
Nextcloud: Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11
Hi, I noticed that the redirecturi used to redirect users to any location on the page, passes in all data into a header"Location.. without any validation. The problem is that PHP current PHP-versions of Debian/Ubuntu, there seem to be a patch properly in place in other dists actually built the...
Veris: Server and PHP version Disclosed in Response Header
Server Version and OS Version Disclosure issue...
LeaseWeb: Apache version disclosed on developer.leaseweb.com
HI For URL "http://developer.leaseweb.com/asdfadsf" apache version is disclosed in response header "Server" Connection: keep-alive Content-Encoding: gzip Content-Length: 174 Content-Type: text/html; charset=iso-8859-1 Date: Sat, 20 Feb 2016 05:11:18 GMT Server: Apache/2.4.7 Vary: User-Agent This...
Ceph: RGW returns requested bucket name raw in Bucket response header
A feature in Ceph Object Gateway RGW allows to return a specific HTTP header that contains the name of a bucket that was accessed. It was found that the returned HTTP headers were not sanitized. An unauthenticated attacker could use this flaw to craft HTTP headers in responses that would confuse...
