CVE-2016-5945

IBM Spectrum Control formerly Tivoli Storage Productivity Center 5.2.x before 5.2.11 allows remote authenticated users to upload non-executable files via a crafted HTTP request...

Cisco Web Security Appliance AsyncOS Denial of Service Vulnerability (CNVD-2016-07730)

Cisco AsyncOS on Web Security Appliance WSA is a set of operating systems running in Web Security Appliance WSA from Cisco USA. A denial of service vulnerability exists in AsyncOS 9.5.0-444 and earlier versions on the Cisco WSA appliance. A remote attacker could exploit this vulnerability by...

CVE-2016-6407

Cisco AsyncOS through 9.5.0-444 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service link saturation by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219...

CVE-2016-6909

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER...

Cisco IP Phone 8800 Series Denial of Service Vulnerability

Cisco IP 8800 Series Phones are digital phone system products. A denial of service vulnerability exists in the Web Server of the Cisco IP Phone 8800 Series. A remote attacker could exploit this vulnerability to cause a denial of service by sending an HTTP request to an affected device...

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker coul...

PT-2016-4806 · Cisco · Cisco Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center versions 4.x through 5.3.0.2, 5.3.1.x through 5.3.1.1, and 5.4.x through 5.4.0.0 Cisco Adaptive Security Appliance ASA Software on 5500-X devices with FirePOWER Services versions 4.x through 5.3.0.2, 5.3.1.x...

Foreman: API permits HTTP requests when require_ssl is enabled

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the requiressl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack...

The vulnerability of the Windows operating system allows a remote attacker to execute arbitrary code within the system account context.

The vulnerability of the HTTP.sys driver on Windows operating systems, which implements the HTTP protocol, lies in the improper handling of HTTP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code within the system account’s context. To exploit this...

The vulnerability of Cisco ASA software allows a malicious actor to induce a service failure.

The vulnerability in the implementation of SSL VPN for Cisco’s multi-functional security devices ASA allows malicious actors to bypass authentication by using specially crafted HTTP POST requests, along with values of cookies or URLs that have been altered...

UBUNTU-CVE-2016-5097

phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading 1 HTTP requests or 2 server logs...

The vulnerability of the Pidgin instant messaging system allows a remote attacker to trigger a service denial or execute arbitrary code.

The Pidgin software contains a vulnerability in the processchukeddata function. Exploiting this vulnerability allows a malicious actor to cause a service failure or execute arbitrary code by manipulating HTTP requests...

CVE-2016-1395

The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP request, aka Bug ID CSCux82428...

CVE-2016-1391

Cisco Prime Network Analysis Module NAM before 6.11 patch.6.1-2-final and 6.2.x before 6.22 and Prime Virtual Network Analysis Module vNAM before 6.11 patch.6.1-2-final and 6.2.x before 6.22 allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID...

squid: Cache poisoning issue in HTTP Request handling

An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid...

OpenNTPD Design Vulnerabilities

OpenNTPD is a network time protocol NTP for Unix systems that can synchronize a computer system's local clock with a remote NTP server. A security vulnerability exists in OpenNTPD that stems from a failure to validate the Common Name when the program is configured for HTTPS requests, which could ...

Google Chrome Competitive Conditions Vulnerability (CNVD-2016-03259)

Google Chrome is a web browser developed by the American company Google Google. Google Chrome versions prior to 50.0.2661.102 have a contention condition vulnerability in the 'ResourceDispatcherHostImpl::' function in the file content/browser/loader/resourcedispatcherhostimpl.cc. BeginRequest'...

UBUNTU-CVE-2016-1670

Race condition in the ResourceDispatcherHostImpl::BeginRequest function in content/browser/loader/resourcedispatcherhostimpl.cc in Google Chrome before 50.0.2661.102 allows remote attackers to make arbitrary HTTP requests by leveraging access to a renderer process and reusing a request ID...

ImageMagick: SSRF vulnerability

A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTPS requests or opening...

The vulnerability of the microprogramming software of the Cisco TelePresence Server allows a intruder to trigger a service failure.

The vulnerability of the microprogramming software of the Cisco TelePresence Server device is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service failures such as memory consumption or device restarting through a specially crafted HTTP...