CVE-2004-2140

CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable...

CVE-2004-2146

CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp...

CVE-2004-2208

CRLF injection vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to conduct HTTP response splitting attacks via unknown vectors...

CVE-2004-1166

CVE-2004-1166 describes a CRLF injection vulnerability in Internet Explorer 6.0.2800.1106 and earlier where an ftp:// URL containing a URL-encoded newline ("%0a") before the FTP command can cause the FTP commands to be injected into the session (e.g., via PORT). The connected MS06-042 bulletin do...

CVE-2004-1166

CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP...

CVE-2004-1166: Improper Control of Generation of Code

CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP...

CVE-2004-1620

CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in 1 index.php and 2 exit.php, or 3 the HTTP Referer field in comment.php...

Debian DSA-168-1 : php - bypassing safe_mode, CRLF injection

Wojciech Purczynski found out that it is possible for scripts to pass arbitrary text to sendmail as commandline extension when sending a mail through PHP even when safemode is turned on. Passing 5th argument should be disabled if PHP is configured in safemode, which is the case for newer PHP...

Debian DSA-210-1 : lynx - CRLF injection

lynx a text-only web browser did not properly check for illegal characters in all places, including processing of command line options, which could be used to insert extra HTTP headers in a request. For Debian GNU/Linux 2.2/potato this has been fixed in version 2.8.3-1.1 of the lynx package and...

CVE-2004-1687

CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the location parameter...

CVE-2002-1405

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters...

CVE-2002-1405

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters...

CVE-2004-1656

CRLF injection vulnerability in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the redirecturl parameter...

CVE-2002-1405

The CVE-2002-1405 issue affects Lynx 2.8.4 and earlier and describes a CRLF injection flaw that lets an attacker add extra HTTP headers via a URL containing encoded CR/LF characters on the command line. Public advisories (Debian DSA-210, RHSA-2003:030, RHSA-2003:030) indicate that updated Lynx pa...

CVE-2002-1405: Undefined Security Weakness

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters...

Lynx Command Line URL CRLF Injection

Binary data 1736.prm...

SUSE-SA:2002:036: mod_php4

The remote host is missing the patch for the advisory SUSE-SA:2002:036 modphp4. PHP is a well known and widely used web programming language. If a PHP script runs in 'safe mode' several restrictions are applied to it including limits on execution of external programs. An attacker can pass shell...

CVE-2002-1575

cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline %0a characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message...

CVE-2002-1575

The CVE-2002-1575 entry concerns cgiemail, a CGI form-mail utility. The vulnerability enables remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline characters in parameters (e.g., required-subject), allowing modification of CC/BCC/header fields in generated emails...

CVE-2002-1575

cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline %0a characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message...