CVE-2019-7313

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

CRLF Injection in pypiserver

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

GHSA-MH24-7WVG-V88G CRLF Injection in pypiserver

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

buildbot -- CRLF injection in Buildbot login and logout redirect code

A CRLF can be injected in Location header of /auth/login and /auth/logout This is due to lack of input validation in the buildbot redirection code. It was not found a way to impact Buildbot product own security through this vulnerability, but it could be used to compromise other sites hosted on t...

CRLF Injection

pypiserver is vulnerable to CRLF injection. A remote attacker is able to inject newline characters %0d%0a into the server response and create arbitrary HTTP headers or perform cross-site scripting attacks. This is due to unescaped values being passed from a client and used directly for redirects...

PYSEC-2019-113

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

CVE-2019-6802

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

Crlf injection

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

CVE-2019-6802

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

CVE-2019-6802

CVE-2019-6802 affects pypiserver up to version 1.2.5, where an attacker can inject carriage return/line feed via a URI (%0d%0a) to set arbitrary HTTP headers and potentially trigger XSS. The root cause is CRLF injection in how certain inputs are handled, enabling header manipulation and possible ...

CVE-2019-6802

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

MariaDB: CRLF injection on https://buildbot.mariadb.org

A CRLF new line injection vulnerability has been discovered in the Buildbot.net software and reported to us. We have forwarded this to the Buildbot developers which coordinated a fix release and public disclosure. This vulnerability has been assigned CVE-2019-7313. More details in the advisory te...

CRLF Injection

ceph is vulnerable to CRLF injection attacks. The vulnerability exists the Ceph Object Gateway aka radosgw or RGW in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name...

MariaDB: CRLF injection at https://mariadb.org/.

A CRLF injection vulnerability was discovered on our website that could lead to attacks such as client side cookie injection. This has been resolved by adjusting the offending rewrite rule in our web server configuration...

urllib3 -- multiple vulnerabilities

NIST reports: by search in the range 2018/01/01 - 2019/11/10: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be...

vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response...

PENTOL - Pentester Toolkit For Fiddler2

PENTOL - Pentester Toolkit is built as a plugin for the Fiddler HTTP debugging proxy. Features CORS DETECTED Cross-Origin Resource Sharing CRLF DETECTED HTTP response splitting Headers DETECTED X-Frame-Options USAGE Install Fiddler2 Open Fiddler2 Press Key CTRL + R or Rules Customize Rules... Cop...

Crlf injection

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...

CVE-2018-7830

The CVE-2018-7830 entry applies to Schneider Electric Modicon embedded web servers (M340, Premium, Quantum PLCs and BMXNOR0200). It is a HTTP Response Splitting issue caused by improper neutralization of CRLF sequences in HTTP headers, leading to a denial of service for about one minute when a sp...

FreeBSD : Gitlab -- Multiple vulnerabilities (8a4aba2d-f33e-11e8-9416-001b217b3468)

Gitlab reports : View Names of Private Groups Persistent XSS in Environments SSRF in Prometheus integration Unauthorized Promotion of Milestones Exposure of Confidential Issue Title Persisent XSS in Markdown Fields via Mermaid Script Persistent XSS in Markdown Fields via Unrecognized HTML Tags...