DEBIAN-CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython aka Python before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL...

Crlf injection

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython aka Python before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL...

EUVD-2016-6641

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython aka Python before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL...

CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython aka Python before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL...

CVE-2016-5699

CVE-2016-5699 is a CRLF injection vulnerability in Python’s HTTPConnection.putheader() used by urllib/urllib2. The flaw allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL. Affected are CPython before 2.7.10 and 3.x before 3.4.4. Consequences include header inject...

CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython aka Python before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL...

PSF-2016-8 HTTP header injection

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython aka Python before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL...

CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython aka Python before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL...

QIWI: [wallet.rapida.ru] XSS Cookie flashcookie

Steps to reproduce 1 Заражаем cookie пользователя. Можно использовать Cookie Injection, XSS или CRLF Injection на .rapida.ru Так как используется Django и не самый свежий Python, то возможно сделать Cookie Injection через Google Analytics тут расписана эта атака https://habrahabr.ru/post/272187/...

VMware vCenter Server/ESXi CRLF Injection Vulnerability

VMware vCenter Server enables rapid deployment of virtual machines and monitors the performance of physical servers and virtual machines. A CRLF injection vulnerability exists in VMware vCenter Server U2 prior to version 6.0 and ESXi 6.0, which can be exploited by remote attackers to inject...

Crlf injection

CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-5331

CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-5331

CVE-2016-5331 describes a CRLF/HTTP header injection vulnerability in VMware vCenter Server 6.0 (before U2) and ESXi 6.0. The underlying issue is CRLF injection that allows remote attackers to manipulate HTTP headers and perform HTTP response splitting via unspecified vectors. Impact is stated as...

IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.10 / Liberty 16.0 < 16.0.0.2 CRLF Sequences HTTP Response Splitting

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.13, 8.5 prior to 8.5.5.10, or 16.0 Liberty prior to 16.0.0.2. It is, therefore, affected by an HTTP response splitting vulnerability due to a failure to properly sanitize CRLF...

ownCloud: [api.owncloud.org] CRLF Injection

PoC: https://api.owncloud.org/%23%0dSet-Cookie:crlf=injection2;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 10:28:01 GMT\r\n Server: Apache\r\n Strict-Transport-Security: max-age=63072000\r\n X-Xss-Protection: 1; mode=block\r\n Location:...

ownCloud: [doc.owncloud.org] CRLF Injection

PoC: http://doc.owncloud.org/%23%0dSet-Cookie:crlf=injection;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 07:58:47 GMT\r\n Server: Apache\r\n Location: https://doc.owncloud.org/\r injection \r Set-Cookie:crlf=injection;domain=.owncloud.org;\r\n...

Apache Httpd < 2.2.32 : mod_userdir CRLF injection

Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value...

Apache Httpd < 2.4.25 : mod_userdir CRLF injection

Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value...

Dropbear: Privilege escalation

Background Dropbear is a relatively small SSH server and client. Description A CRLF injection vulnerability in Dropbear SSH allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data. Impact A remote authenticated user could execute arbitrary...

dotCMS < 3.3.2 Multiple Vulnerabilities

dotCMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dotcms:dotcms"; if description...