CWE-444 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-444/ Sun, 26 Feb 2023 06:51:15 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-444 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-444/ 32 32 CVE-2018-8004 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8004/ Sun, 26 Feb 2023 06:51:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8004/ There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

The post CVE-2018-8004 appeared first on CVE Vulnerability.

]]> There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

The post CVE-2018-8004 appeared first on CVE Vulnerability.

]]> CVE-2018-7068 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7068/ Sun, 26 Feb 2023 06:50:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7068/ HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.

The post CVE-2018-7068 appeared first on CVE Vulnerability.

]]> HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.

The post CVE-2018-7068 appeared first on CVE Vulnerability.

]]> CVE-2018-4030 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-4030/ Sun, 26 Feb 2023 06:49:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-4030/ An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The “Host” header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any malicious websites and bypass the firewall. An attacker could […]

The post CVE-2018-4030 appeared first on CVE Vulnerability.

]]> An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The “Host” header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any malicious websites and bypass the firewall. An attacker could send an HTTP request to exploit this vulnerability.

The post CVE-2018-4030 appeared first on CVE Vulnerability.

]]> CVE-2018-3907 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3907/ Sun, 26 Feb 2023 06:49:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3907/ An exploitable vulnerability exists in the REST parser of video-core’s HTTP server of the Samsung SmartThings Hub STH-ETH-250 – Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, ‘on_url’ callback. An attacker can send an HTTP request to trigger this vulnerability.

The post CVE-2018-3907 appeared first on CVE Vulnerability.

]]> An exploitable vulnerability exists in the REST parser of video-core’s HTTP server of the Samsung SmartThings Hub STH-ETH-250 – Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, ‘on_url’ callback. An attacker can send an HTTP request to trigger this vulnerability.

The post CVE-2018-3907 appeared first on CVE Vulnerability.

]]> CVE-2018-3908 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3908/ Sun, 26 Feb 2023 06:49:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3908/ An exploitable vulnerability exists in the REST parser of video-core’s HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. With the implementation of the on_body callback, defined by sub_41734, an attacker can […]

The post CVE-2018-3908 appeared first on CVE Vulnerability.

]]> An exploitable vulnerability exists in the REST parser of video-core’s HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. With the implementation of the on_body callback, defined by sub_41734, an attacker can send an HTTP request to trigger this vulnerability.

The post CVE-2018-3908 appeared first on CVE Vulnerability.

]]> CVE-2018-3909 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3909/ Sun, 26 Feb 2023 06:49:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3909/ An exploitable vulnerability exists in the REST parser of video-core’s HTTP server of the Samsung SmartThings Hub STH-ETH-250 – Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, ‘onmessagecomplete’ callback. An attacker can send an HTTP request to trigger this vulnerability.

The post CVE-2018-3909 appeared first on CVE Vulnerability.

]]> An exploitable vulnerability exists in the REST parser of video-core’s HTTP server of the Samsung SmartThings Hub STH-ETH-250 – Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, ‘onmessagecomplete’ callback. An attacker can send an HTTP request to trigger this vulnerability.

The post CVE-2018-3909 appeared first on CVE Vulnerability.

]]> CVE-2018-21245 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-21245/ Sun, 26 Feb 2023 06:48:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-21245/ Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

The post CVE-2018-21245 appeared first on CVE Vulnerability.

]]> Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.

The post CVE-2018-21245 appeared first on CVE Vulnerability.

]]> CVE-2020-9490 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-9490/ Sun, 26 Feb 2023 06:43:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-9490/ Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the ‘Cache-Digest’ header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via “H2Push off” will mitigate this vulnerability for unpatched servers.

The post CVE-2020-9490 appeared first on CVE Vulnerability.

]]> Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the ‘Cache-Digest’ header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via “H2Push off” will mitigate this vulnerability for unpatched servers.

The post CVE-2020-9490 appeared first on CVE Vulnerability.

]]> CVE-2020-8287 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8287/ Sun, 26 Feb 2023 06:43:21 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8287/ Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

The post CVE-2020-8287 appeared first on CVE Vulnerability.

]]> Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

The post CVE-2020-8287 appeared first on CVE Vulnerability.

]]> CVE-2020-8201 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8201/ Sun, 26 Feb 2023 06:43:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8201/ Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible […]

The post CVE-2020-8201 appeared first on CVE Vulnerability.

]]> Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

The post CVE-2020-8201 appeared first on CVE Vulnerability.

]]>