The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.

Computer vulnerabilities of Protocol HTTP

HTTP: Man-in-the-Middle via Proxy CONNECT
An attacker can act as a Man-in-the-Middle when an HTTP proxy is configured, in order to obtain passwords of users of this proxy...
FalseCONNECT, VIGILANCE-VUL-20428, VU#905344
HTTPS: Cookie injection
An attacker can inject a cookie in an HTTPS (HTTP+TLS) session, in order to alter the behavior of the web service, if it is not conceived to receive unexpected cookies...
VIGILANCE-VUL-17985, VU#804060
HTTP: incoherent handling of parameters
The HTTP protocol does not define the behavior of web servers when a request contains the same variable several times, which can generate vulnerabilities...
BID-35323, VIGILANCE-VUL-8726
HTTP: capturing a cookie
An attacker can obtain a cookie which does not have the secure attribute...
BID-31321, CERTA-2008-AVI-529, CVE-2008-3663, FEDORA-2008-8559, FEDORA-2008-9071, MDVSA-2009:053, RHSA-2009:0010-01, RHSA-2009:0057-01, SUSE-SR:2008:028, VIGILANCE-VUL-8127
HTTP : injection de réponses
Un attaquant peut injecter des données dans une requête HTTP dans le but de produire deux ou plusieurs réponses HTTP...
20050203-01-U, BID-9804, c01178795, CERTA-2008-AVI-008, CERTA-2009-AVI-032, CVE-2005-0175, CVE-2005-1389-REJECT, CVE-2005-2090, DSA-667, DSA-667-1, FEDORA-2014-13764, FEDORA-2014-13777, FLSA-2006:152809, HPSBUX02262, MDKSA-2005:034, RHSA-2005:060, RHSA-2005:061, RHSA-2008:0261-01, SGI 20050203, SQUID-2005_5, SSRT071447, SUSE-SA:2005:006, TLSA-2005-24, V6-HTTPRESPONSESPLITTING, VIGILANCE-VUL-4047, VU#625878
Utilisation de la méthode TRACE en complément d'une attaque Cross Site Scripting
La méthode HTTP TRACE permet d'obtenir des compléments d'informations suite à une attaque de type Cross Site Scripting...
101176, 102016, 1201202, 200171, 200942, 5063481, 5090761, BEA04-48.00, BEA-048, BID-11604, BID-15222, BID-9506, BID-9561, c00612828, CVE-2004-2320, CVE-2005-3398, HP279, HPSBUX02101, KM03235847, SSRT051128, Sun Alert 50603, Sun Alert 57670, Sun Alert ID 50603, Sun Alert ID 57670, Sun BugID 4808654, Sun BugID 5063481, V6-XSSTRACING, VIGILANCE-VUL-3278, VU#867593
Suivi des sessions des utilisateurs
Lorsque l'utilisateur a désactivé les cookies, un site web peut tout de même lui créer un profil en utilisant les entêtes ETag ou Last-Modified...
V6-HTTPETAGLASTMODSES, VIGILANCE-VUL-3964
Our database contains other pages. You can request a free trial to read them.

Display information about Protocol HTTP: