4031 matches found
CVE-2020-4361
IBM Planning Analytics 2.0 is affected by an information-disclosure vulnerability where a remote attacker could cause private IP addresses to be exposed in HTTP responses. The issue affects the Planning Analytics Local / Workspace component of IBM Planning Analytics 2.0, with root cause described...
Authorization Bypass
jetty-server is vulnerable to authorization bypass. The vulnerability exists as a buffer corruption could occur when the response buffer is too large, allowing the header buffer to be released, but not nulled, causing the server to send incorrect responses to different clients...
OPENSUSE-SU-2020:0910-1 Security update for squid
This update for squid fixes the following issues: squid was updated to version 4.12 Security issue fixed: - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed: - Reverted to slow search for new SMP s...
CVE-2020-4060
In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message https://doc.sm.tc/station/cupsproto.htmlhttp-post-response where the signature length is larger than ...
PT-2020-14068 · Dmitry · Dmitry
Name of the Vulnerable Software and Affected Versions: DMitry version 1.3a Description: A stack-based buffer overflow might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by the nic format buff function. Recommendations: For DMitry version...
resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class
A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...
CVE-2020-13960
D-Link DSL 2730-U IN1.10 and IN1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote attackers to provide valid DNS responses and also offer Internet services such as HTTP for names that otherwise would have had an NXDOMAIN erro...
Design/Logic Flaw
D-Link DSL 2730-U IN1.10 and IN1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote attackers to provide valid DNS responses and also offer Internet services such as HTTP for names that otherwise would have had an NXDOMAIN erro...
unbound: infinite loop via malformed DNS answers received from upstream servers
A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...
CVE-2020-11077
A flaw was found in rubygem-puma. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first...
HTTP Response Splitting
kallithea is vulnerable to HTTP Response Splitting. It is possible because it does not escape the user-provided input from GET 'camefrom' parameter in the login instance, allowing an attacker to inject malicious HTTP headers to control the remaining headers and body of the response of the...
Centreon Information Disclosure Vulnerability (CNVD-2020-31118)
Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A security vulnerability exists in Centreon versions prior to 19.10.7, which is caused...
CVE-2020-10945
Centreon before 19.10.7 exposes Session IDs in server responses...
CVE-2020-10945
Centreon before 19.10.7 exposes Session IDs in server responses...
Design/Logic Flaw
Centreon before 19.10.7 exposes Session IDs in server responses...
UBUNTU-CVE-2020-10945
Centreon before 19.10.7 exposes Session IDs in server responses...
CVE-2020-10945
Centreon before 19.10.7 exposes Session IDs in server responses...
Cross site request forgery (csrf)
In Puma RubyGem before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the firs...
Unknown Vulnerability in Unbound
Unbound is a DNS resolver from the NLnet Labs Foundation in the Netherlands that supports verified recursion and caching. An unspecified vulnerability exists in Unbound. An attacker can exploit this vulnerability to cause an infinite loop with a specially crafted DNS response...