CVE-2023-4768

ManageEngine Desktop Central 9.1.0 is affected by a CRLF injection vulnerability that could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.pdf. The vulnerability is confirmed across m...

CVE-2023-4768 Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATEID/1613157927228/InvSWMetering.p...

CVE-2023-4767 Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATEID/1613157927228/InvSWMetering.c...

CVE-2023-4767

CVE-2023-4767 describes a CRLF injection in ManageEngine Desktop Central v9.1.0. The vulnerability affects the fileName parameter in the endpoint "/STATE_ID/1613157927228/InvSWMetering.csv", enabling an attacker to inject arbitrary HTTP headers and perform HTTP response splitting. Exploitation st...

CVE-2023-4767 Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATEID/1613157927228/InvSWMetering.c...

ZOHO ManageEngine Desktop Central Injection Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. An injection...

ZOHO ManageEngine Desktop Central Injection Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. An injection...

PT-2023-30555 · Zoho · Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: ManageEngine Desktop Central version 9.1.0 Description: A CRLF injection vulnerability has been found in ManageEngine Desktop Central. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response...

Debian dla-3610 : python-urllib3 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3610 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3610-1 [email protected]...

TikTok: CRLF injection leads to internal XSS on PangleGlobal

A cross-site scripting vulnerability was discovered due to carriage return line feed injection on the filename parameter of a PangleGlobal endpoint. This could have allowed JavaScript code execution in a user's browser through reflected cross-site scripting. The vulnerability has since been...

CVE-2023-26148

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n carriage return line feeds characters and inject additional headers in the request sent...

CVE-2023-26148

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n carriage return line feeds characters and inject additional headers in the request sent...

Crlf injection

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n carriage return line feeds characters and inject additional headers in the request sent...

CVE-2023-26148

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n carriage return line feeds characters and inject additional headers in the request sent...

CVE-2023-26148

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n carriage return line feeds characters and inject additional headers in the request sent...

CVE-2023-26148

CVE-2023-26148 affects the ithewei/libhv package. All versions are reported vulnerable to CRLF Injection when untrusted input is used to set HTTP request headers, allowing an attacker to inject additional headers by inserting CRLF characters. The CVE is corroborated across multiple sources (NVD, ...

libhv Injection Vulnerability

libhv is ithewei open source an easier to use than libevent/libuv/asio network library . libhv injection vulnerability , the vulnerability stems from when the use of untrusted user input to set the request header , vulnerable to CRLF injection attacks...

PT-2023-20525 · Unknown · Ithewei/Libhv

Name of the Vulnerable Software and Affected Versions: ithewei/libhv versions all Description: The issue arises when untrusted user input is used to build header values, allowing an attacker to inject malicious content by adding carriage return line feeds r to end the HTTP response headers. This...

PT-2023-20526 · Unknown · Ithewei/Libhv

Name of the Vulnerable Software and Affected Versions: ithewei/libhv versions all Description: The issue affects the ithewei/libhv package, where untrusted user input used to set request headers can lead to CRLF Injection. An attacker can inject additional headers into the request by adding...

nodejs: HTTP Request Smuggling via Empty headers separated by CR

A vulnerability has been identified in the Node.js, where llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...