3785 matches found
CVE-2016-4803
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...
CVE-2016-4803
CVE-2016-4803 affects dotCMS prior to 3.3.2, where the sendEmail functionality is vulnerable to CRLF injection in the subject, enabling remote attackers to inject arbitrary email headers. Root cause is unsanitized CRLF sequences in email header fields. Impact described as header injection risk fo...
Crlf injection
The dsasignsetup function in crypto/dsa/dsaossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack...
CVE-2016-1224
CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...
CVE-2016-1224
CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...
Crlf injection
CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...
CVE-2016-1224
CVE-2016-1224 involves an HTTP header injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0. Connected sources confirm that this vulnerability allows injection of HTTP headers and may enable cross-site scripting under certain conditio...
CVE-2016-1224
CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...
SUSE SLES11 Security Update : openssh (SUSE-SU-2016:1528-1)
openssh was updated to fix three security issues. These security issues were fixed : - CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related t...
Ubiquiti Inc.: [account-global.ubnt.com] CRLF Injection
PoC any browser except FireFox: http://account-global.ubnt.com/%3f%0dSet-Cookie:crlf=injection%3bdomain=.ubnt.com%3b HTTP Response: HTTP/1.1 302 Found Content-Type: text/html; charset=iso-8859-1 Date: Thu, 16 Jun 2016 09:59:15 GMT Location: https://account-global.ubnt.com/index.html? = injection ...
Sucuri: [support.sucuri.net] CRLF Injection
PoC any browser except FireFox: http://support.sucuri.net/%23%0dSet-Cookie:crlf=injection;domain=.sucuri.net; HTTP Response: HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jun 2016 19:56:14 GMT Server: Apache Location: https://support.sucuri.net/ = injeciton \r...
Mail.ru: [sales.mail.ru] CRLF Injection
В разделе media портала sales.mail.ru существует редирект, который удаляет GET-параметры: GET https://sales.mail.ru/media/foo?bar 302 Moved Temporarily Location: http://sales.mail.ru/media/foo Он подвержен CRLF-инъекции, что позволяет атакующему внедрить произвольный заголовок в ответ сервера: GE...
Mail.ru: [torg.mail.ru] CRLF Injection
Редирект http://torg.mail.ru//foo → http://torg.mail.ru/foo подвержен CRLF-инъекции, что позволяет атакующему внедрить произвольный заголовок в ответ сервера. Пример установки значения куки для всего домена mail.ru: GET http://torg.mail.ru//xxx%0ASet-Cookie:test=test;domain=.mail.ru 301 Moved...
EMC RSA Authentication Manager CRLF Injection Vulnerability
RSA Authentication Manager: is the platform behind RSA SecurID, utilized to centrally manage the RSA SecurID environment, including authentication methods, users, applications, and agents, across multiple physical sites. A security vulnerability exists in RSA Authentication Manager versions prior...
CVE-2016-0902
CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...
CVE-2016-0902
CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...
Crlf injection
CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...
CVE-2016-0902
CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...
CVE-2016-0902
EMC RSA Authentication Manager before 8.1 SP1 Patch 14 is affected by a CRLF injection vulnerability (CVE-2016-0902) that could allow an unauthenticated attacker to inject arbitrary HTTP headers and perform HTTP response splitting in unspecified vectors. Connected sources consistently identify th...