Fedora 24 : wget (2017-ed1c665a3f)

Fixed CVE-2017-6508: CRLF injection in the urlparse function in url.c Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Snapchat: CRLF Injection at vpn.bitstrips.com

HI I found that the site https://vpn.bitstrips.com/ is vulnerable to a CRLF Injection. By injecting a Carriage Return and Line Feed character, we are able to make the server issue a set-cookie header. GET Request : https://vpn.bitstrips.com/sessionstart/%0aSet-Cookie:maliciouscookie1 Host:...

Mixmax: CRLF Injection on https://vpn.mixmax.com

Hey guys, I found that the site https://vpn.mixmax.com is vulnerable to a CRLF Injection. By injecting a Carriage Return and Line Feed character, we are able to make the server issue a set-cookie header. Proof-of-Concept: ==============...

OpenVPN Access Server : CRLF injection with Session fixation(CVE-2017-5868)

Description OpenVPN Access Server is a full featured secure network tunneling VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client software packages that accommodate Windows, MAC, Linux, Android, a...

OpenVPN Access Server 2.1.4 CRLF Injection

OpenVPN Access Server : CRLF injection with Session fixation Description OpenVPN Access Server is a full featured secure network tunneling VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client...

Ubiquiti Inc.: CRLF Injection on openvpn.svc.ubnt.com

The researcher reported the vulnerability CVE-2017-5868 in one of our server, it got promptly mitigated, once no oficial patch was available at the time of submit. Ubiquiti's employee VPN server was vulnerable to CVE-2017-5868, the issue was reported to them by me and quickly patched. Thank you...

CVE-2017-5868

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...

Crlf injection

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...

CVE-2017-5868

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...

CVE-2017-5868

OpenVPN Access Server 2.1.4 is affected by a CRLF injection in the web interface that can be triggered via %0A in PATH_INFO to session_start , enabling header injection and potentially session fixation attacks (and possibly HTTP response splitting). The vulnerability is documented across multiple...

CVE-2017-5868

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...

Cuvva: CRLF Injection [vpn.corp.cuvva.com]

Hi team, Found a CRLF injection in vpn.corp.cuvva.com Poc https://vpn.corp.cuvva.com/sessionstart/%0aSet-Cookie:NEWCOOKIE123 Response: HTTP/1.1 302 Found Date: Wed, 24 May 2017 18:13:57 GMT Connection: close Content-Type: text/html; charset=UTF-8 Location: https://vpn.corp.cuvva.com/...

OpenVPN Access Server CRLF Injection Vulnerability

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for virtual private networks VPNs that use the OpenSSL library to encrypt data and control information.OpenVPN Access Server is a commercial paid version of OpenVPN. OpenVPN Access Server suffers from a...

Crlf injection

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir

It was found that Apache was vulnerable to a HTTP response splitting attack for sites which use moduserdir. An attacker could use this flaw to inject CRLF characters into the HTTP header and could possibly gain access to secure data...

Trend Micro InterScan Web Security Virtual Appliance transparent_setting CRLF Injection Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within transparentsetting. The issue results from the lac...

HackerOne: CRLF injection in info.hacker.one

Vulnerable URL: info.hacker.one Vulnerability description This script is possibly vulnerable to CRLF injection attacks. HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly...

IBM WebSphere Application Server 8.0.0.x < 8.0.0.13 Multiple Vulnerabilities

Binary data 700016.prm...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.43 Multiple Vulnerabilities

Binary data 700015.prm...

GNU Wget CRLF Injection Vulnerability (CNVD-2017-03817)

GNU Wget is a set of free software developed by the GNU Project for downloading over the Internet, which supports downloading over the three most common TCP/IP protocols: HTTP, HTTPS, and FTP. A CRLF injection vulnerability exists in the 'urlparse' function of the url.c file in GNU Wget 1.19.1 an...