21 matches found
📄 Varnish / Styx HTTP Request Smuggling
Proof of concept exploit that demonstrates an HTTP request smuggling vulnerability between Varnish and Styx / Nginx. ============================================================================================================================================= | Title : HTTP Request Smuggling TE.CL...
EUVD-2020-0336
Malware in sbrugna...
Styx Stealer Creator's OPSEC Fail Leaks Client List and Profit Details
In what's a case of an operational security OPSEC lapse, the operator behind a new information stealer called Styx Stealer leaked data from their own computer, including details related to the clients, profit information, nicknames, phone numbers, and email addresses. Styx Stealer, a derivative o...
Input validation
An authenticated attacker with administrative access to the appliance can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will later be executed by another legitimate user viewing the details of such a rule. An attacker may be able to perform unauthorize...
CVE-2023-22843
CVE-2023-22843 is a stored XSS vulnerability in Nozomi Guardian/CMC where an authenticated administrator can inject JavaScript into Threat Intelligence rule definitions (yara content; limited HTML for packet/STYX), which then executes in other users’ sessions. Impact includes unauthorized actions...
CVE-2023-22843: Improper Neutralization of Input During Web Page Generation
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Via stored...
New Dark Web Market Styx: Focuses on Money Laundering, Identity Theft
By Deeba Ahmed Styx has quickly gained traction as a hub for various illicit activities, following the recent seizure of the Genesis dark web market. This is a post from HackRead.com Read the original post: New Dark Web Market Styx: Focuses on Money Laundering, Identity Theft...
CVE-2020-6858
Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header...
CVE-2020-6858
Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header...
CVE-2020-6858
Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header...
Crlf injection
Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header...
CVE-2020-6858
Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header...
CVE-2020-6858
Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header...
CVE-2020-6858
CVE-2020-6858 affects Hotels Styx up to 1.0.0.beta8. The issue is HTTP Response Splitting (CRLF injection) caused by disabling Netty’s HTTP header validation in Styx code paths: HttpHeaders.Builder configured with new DefaultHttpHeaders(false) and StyxToNettyResponseTranslator creating DefaultHtt...
CVE-2020-6858: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header...
HTTP Response Splitting
Styx is vulnerable HTTP Response Splitting. The vulnerability exists because the StyxToNettyResponseTranslator and Builder classes of StyxToNettyResponseTranslator.javaand HttpHeaders.java do not validate the HTTP Header built into Netty respectively, allowing an attacker to inject CRLF Sequences...
GHSA-6V7P-V754-J89V HTTP Response Splitting in Styx
Vulnerability Styx is vulnerable to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting'. Vulnerable Component The vulnerable component is the com.hotels.styx.api.HttpHeaders.Builder due to disabling the HTTP Header validation built into Netty in these...
HTTP Response Splitting in Styx
Vulnerability Styx is vulnerable to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting'. Vulnerable Component The vulnerable component is the com.hotels.styx.api.HttpHeaders.Builder due to disabling the HTTP Header validation built into Netty in these...
PT-2020-19270
Name of the Vulnerable Software and Affected Versions Hotels Styx versions prior to 1.0.0.beta9 Description The issue allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header. Recommendations For versions prior to 1.0.0.beta...
