PayloadsAllTheThings

This is an offensive tool repository for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass techniques for various web application vulnerabilities. The repository includes tools and scripts for exploiting vulnerabilities such as CRLF injection, CSRF...

CRLF Injection

waitress is vulnerable to CRLF injection. The vulnerability exists due to the different ways in which carriage returns and line feed characters are parsed in the server and the client. This cab potentially lead to HTTP request smuggling and splitting vulnerabilities...

Security Bulletin: Python as used by IBM QRadar Network Packet Capture is vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers (CVE-2019-9947, CVE-2019-9948)

Summary The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. Vulnerability Details CVEID: CVE-2019-9947 DESCRIPTION: An issue was discovered in urllib2 in Python 2.x...

GitHub Security Lab: Netty HTTP Response Splitting (CRLF Injection) due to disabled header validation

This bug was reported directly to GitHub Security Lab...

EulerOS 2.0 SP3 : python (EulerOS-SA-2019-2653)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly pars...

EulerOS 2.0 SP3 : wget (EulerOS-SA-2019-2681)

According to the version of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - CRLF injection vulnerability in the urlparse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRL...

EulerOS 2.0 SP2 : httpd (EulerOS-SA-2019-2402)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4....

Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4212-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4212-1 advisory. Tim Dsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to execute arbitrary code through CRLF...

Ubuntu: Security Advisory (USN-4212-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4212-1: HAProxy vulnerability

Tim Düsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to execute arbitrary code through CRLF injection...

USN-4212-1 haproxy vulnerability

Tim Düsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to execute arbitrary code through CRLF injection...

EulerOS 2.0 SP2 : python (EulerOS-SA-2019-2442)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as...

EulerOS 2.0 SP2 : wget (EulerOS-SA-2019-2501)

According to the version of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - CRLF injection vulnerability in the urlparse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRL...

FreeBSD : urllib3 -- multiple vulnerabilities (87270ba5-03d3-11ea-b81f-3085a9a95629)

NIST reports: by search in the range 2018/01/01 - 2019/11/10 : urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be...

HAProxy CVE-2019-19330 CRLF Injection Vulnerability

Description HAProxy is prone to a CRLF-injection vulnerability. An attacker can exploit this issue to add arbitrary headers to a webpage. This may aid in further attacks. HAProxy versions prior to 2.0.10 are vulnerable. Technologies Affected haproxy haproxy 1.4 haproxy haproxy 1.4.0 haproxy hapro...

Amazon Linux AMI : python34 (ALAS-2019-1324)

A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies,...

Important: python34

Issue Overview: A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store...

EulerOS 2.0 SP5 : python (EulerOS-SA-2019-2225)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This...

EulerOS 2.0 SP5 : python-urllib3 (EulerOS-SA-2019-2184)

According to the version of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.CVE-2019-11236...

EulerOS 2.0 SP3 : python-urllib3 (EulerOS-SA-2019-2239)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.CVE-2019-1123...