CVE-2021-31164 Apache Unomi log injection

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements...

Apache Unomi 注入漏洞

Apache Unomi is the United States Apache Software Apache Foundation's set of open source customer data platform. The platform is mainly written in Java language. An injection vulnerability exists in Apache Unomi versions prior to 1.5.5. The vulnerability stems from the failure of a networked syst...

CVE-2021-0268 Junos OS: J-Web has an Improper Neutralization of CRLF Sequences in its HTTP Headers which allows an attacker to carry out multiple types of attacks.

An Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' weakness in J-web of Juniper Networks Junos OS leads to buffer overflows, segment faults, or other impacts, which allows an attacker to modify the integrity of the device and exfiltration information from the...

CVE-2021-0268

CVE-2021-0268 concerns Juniper Networks Junos OS J-Web, due to an Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Response Splitting). The weakness can cause buffer overflows or segment faults and, per sources, may enable cross-site scripting (XSS) and cookie manipulation, with th...

Ruby: 'net/http': HTTP Header Injection in the set_content_type method

The set\content\type's parameter is not filtered to prevent the injection from altering the entire request. The vulnerable code: ruby def setcontenttypetype, params = @header'content-type' = type + params.map|k,v|"; k=v".join'' end PoC 1. ruby require 'net/http' uri = URI'http://127.0.0.1:8080' r...

SUSE: Security Advisory (SUSE-SU-2021:0341-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:0750-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3563-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3121-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:0299-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-31402

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669...

CVE-2021-31402

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669...

Crlf injection

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669...

CVE-2021-31402

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669...

CVE-2021-31402

CVE-2021-31402 affects the dio package for Dart, specifically version 4.0.0, where CRLF injection is possible when an attacker controls the HTTP method string. The issue is a distinct vulnerability from CVE-2020-35669 and is documented as a CRLF sequence handling flaw in the Dio HTTP client. Patc...

PT-2021-19283 · Dio · Dio

Name of the Vulnerable Software and Affected Versions: dio package versions prior to 5.0.0 Description: The issue allows CRLF injection if the attacker controls the HTTP method string. This is a different issue than previously identified problems. Recommendations: For dio package versions prior t...

Security Bulletin: Vulnerability in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager (CVE-2020-26116)

Summary A Vulnerability in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager CVE-2020-26116 Vulnerability Details CVEID: CVE-2020-26116 DESCRIPTION: Python is vulnerable to CRLF injection, caused by improper validation of user-supplied input in http.client. By inserti...

Ubuntu 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-4754-3)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4754-3 advisory. USN-4754-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04. In the case of...

Mail.ru: Open Redirect and CRLF Injection Leads to XSS on [app.doma.uchi.ru]

XSS on app.doma.uchi.ru created by two vulnerabilities: open redirect issue request parameter location was not validated In Ruby on Rails version 6.0.3.2 and a CRLF injection...

Debian DLA-2592-1 : golang-1.8 security update

Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial of service DoS, bypasss access control, and execute arbitrary code on the developer's computer. CVE-2017-15041 Go allows 'go get' remote command execution. Using custom domains, it is possib...