Total
204 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-19326 | 1 Silverstripe | 1 Silverstripe | 2020-07-23 | 4.3 MEDIUM | 5.9 MEDIUM |
| Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache poisoning. Through modifying the X-Original-Url and X-HTTP-Method-Override headers, responses with malicious HTTP headers can return unexpected responses to other consumers of this cached response. Most other headers associated with web cache poisoning are already disabled through request hostname forgery whitelists. | |||||
| CVE-2019-20866 | 1 Mattermost | 1 Mattermost Server | 2020-06-29 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled. | |||||
| CVE-2018-21245 | 1 Apsis | 1 Pound | 2020-06-22 | 6.4 MEDIUM | 9.1 CRITICAL |
| Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711. | |||||
| CVE-2020-7659 | 1 Celluloid | 1 Reel | 2020-06-02 | 5.0 MEDIUM | 7.5 HIGH |
| reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is not maintained any more. | |||||
| CVE-2020-7655 | 1 Hive | 1 Netius | 2020-05-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks. | |||||
| CVE-2016-10711 | 2 Apsis, Debian | 2 Pound, Debian Linux | 2020-04-30 | 7.5 HIGH | 9.8 CRITICAL |
| Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. | |||||
| CVE-2020-7611 | 1 Objectcomputing | 1 Micronaut | 2020-04-02 | 7.5 HIGH | 9.8 CRITICAL |
| All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client. | |||||
| CVE-2020-5129 | 1 Sonicwall | 2 Sma1000, Sma1000 Firmware | 2020-03-30 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of Service. This vulnerability affected SMA1000 Version 12.1.0-06411 and earlier. | |||||
| CVE-2020-5401 | 1 Cloudfoundry | 1 Routing Release | 2020-03-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app. | |||||
| CVE-2020-5218 | 1 Sylius | 1 Sylius | 2020-02-07 | 4.0 MEDIUM | 4.3 MEDIUM |
| Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false. Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore. | |||||
| CVE-2020-5220 | 1 Sylius | 1 Syliusresourcebundle | 2020-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3. | |||||
| CVE-2020-5207 | 1 Jetbrains | 1 Ktor | 2020-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator. | |||||
| CVE-2019-15272 | 1 Cisco | 1 Unified Communications Manager | 2019-10-09 | 6.4 MEDIUM | 6.5 MEDIUM |
| A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to bypass security restrictions. The vulnerability is due to improper handling of malformed HTTP methods. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to gain unauthorized access to the system. | |||||
| CVE-2017-7559 | 1 Redhat | 1 Undertow | 2019-10-09 | 5.8 MEDIUM | 6.1 MEDIUM |
| In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. | |||||
| CVE-2017-2666 | 2 Debian, Redhat | 4 Debian Linux, Enterprise Linux, Jboss Enterprise Application Platform and 1 more | 2019-10-09 | 6.4 MEDIUM | 6.5 MEDIUM |
| It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. | |||||
| CVE-2017-12165 | 1 Redhat | 2 Jboss Enterprise Application Platform, Undertow | 2019-10-09 | 5.0 MEDIUM | 7.5 HIGH |
| It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling. | |||||
| CVE-2017-12158 | 2 Keycloak, Redhat | 3 Keycloak, Enterprise Linux Server, Single Sign On | 2019-10-09 | 3.5 LOW | 5.4 MEDIUM |
| It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server. | |||||
| CVE-2017-7561 | 1 Redhat | 1 Jboss Enterprise Application Platform | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact. | |||||
| CVE-2019-1020012 | 1 Parseplatform | 1 Parse-server | 2019-08-02 | 5.0 MEDIUM | 7.5 HIGH |
| parse-server before 3.4.1 allows DoS after any POST to a volatile class. | |||||
| CVE-2015-5739 | 3 Fedoraproject, Golang, Redhat | 6 Fedora, Go, Enterprise Linux Server and 3 more | 2019-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length." | |||||