CVE-2007-3686

CRLF injection vulnerability in db.php in Unobtrusive Ajax Star Rating Bar before 1.2.0 allows remote attackers to inject arbitrary HTTP headers and data via CRLF sequences in the HTTPREFERER parameter...

CVE-2007-3709: Undefined Security Weakness

CRLF injection vulnerability in the redirect function in urlhelper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in an unspecified parameter, as demonstrated by a Set-Cookie header...

CVE-2007-3686: Undefined Security Weakness

CRLF injection vulnerability in db.php in Unobtrusive Ajax Star Rating Bar before 1.2.0 allows remote attackers to inject arbitrary HTTP headers and data via CRLF sequences in the HTTPREFERER parameter...

CVE-2007-3621

Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the 1 IN and 2 OUT parameters...

Crlf injection

Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the 1 IN and 2 OUT parameters...

CVE-2007-3621

CVE-2007-3621 involves multiple CRLF injection flaws in the AsteriDex 3.0 and earlier versions, exploitable through the callboth.php IN/OUT parameters to potentially execute arbitrary shell commands on the remote host. The vulnerability stems from inadequate input sanitization before relaying dat...

CVE-2007-3621

Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the 1 IN and 2 OUT parameters...

CVE-2007-3621: Undefined Security Weakness

Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the 1 IN and 2 OUT parameters...

AsteriDex callboth.php Multiple Parameter CRLF Injection Arbitrary Command Execution

The remote host is running AsteriDex, a web-based dialer and address book for Asterisk. The version of AsteriDex installed on the remote host fails to sanitize input to the 'IN' parameter of the 'callboth.php' script before passing it to the Asterisk Call Manager as part of the data stream of an...

Important: php security update

5.1.6-12.el5 - add security fix for CVE-2007-1864, SOAP redirect handling issue, FTP CRLF injection issue 235016 5.1.6-11.el5 - add security fix for CVE-2007-1718 235016 5.1.6-9.el5 - add security fix for CVE-2007-1583 235016 - add security fixes for CVE-2007-0455, CVE-2007-1001 235036 5.1.6-7.el...

Crlf injection

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function...

CVE-2007-2401

The CVE-2007-2401 entry concerns a CRLF injection in Apple’s WebCore XMLHttpRequest handling. Vulnerable: WebCore in Mac OS X 10.3.9, 10.4.9 and later, and iPhone prior to 1.0.1. Nature: remote attacker can inject arbitrary HTTP headers by sending LF characters in an XMLHttpRequest and exploiting...

CVE-2007-2401

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function...

CVE-2007-2401: Improper Neutralization of Input During Web Page Generation

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function...

CVE-2007-3208

CRLF injection vulnerability in Yet another Bulletin Board YaBB 2.1 allows remote attackers to obtain administrative access via requests to 1 register.pl or 2 profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code...

Crlf injection

CRLF injection vulnerability in Yet another Bulletin Board YaBB 2.1 allows remote attackers to obtain administrative access via requests to 1 register.pl or 2 profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code...

CVE-2007-3208

CRLF injection vulnerability in YaBB 2.1 allows remote attackers to obtain administrative access through requests to register.pl or profile.pl that write CRLF sequences to a .vars file; this may enable execution of arbitrary code. No patch/version details are provided in the supplied documents.

CVE-2007-3208

CRLF injection vulnerability in Yet another Bulletin Board YaBB 2.1 allows remote attackers to obtain administrative access via requests to 1 register.pl or 2 profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code...

CVE-2007-3208: Undefined Security Weakness

CRLF injection vulnerability in Yet another Bulletin Board YaBB 2.1 allows remote attackers to obtain administrative access via requests to 1 register.pl or 2 profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code...

[Full-disclosure] iDefense Security Advisory 06.12.07: YaBB Forum member.vars CRLF Injection Privilege Escalation Vulnerability

YaBB Forum member.vars CRLF Injection Privilege Escalation Vulnerability iDefense Security Advisory 06.12.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jun 12, 2007 I. BACKGROUND YaBB Yet another Bulletin Board is an Open Source community forum system written in Perl. More information...