CVE-2016-1224

CVE-2016-1224 involves an HTTP header injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0. Connected sources confirm that this vulnerability allows injection of HTTP headers and may enable cross-site scripting under certain conditio...

CVE-2016-1224

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...

SUSE SLES11 Security Update : openssh (SUSE-SU-2016:1528-1)

openssh was updated to fix three security issues. These security issues were fixed : - CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related t...

Ubiquiti Inc.: [account-global.ubnt.com] CRLF Injection

PoC any browser except FireFox: http://account-global.ubnt.com/%3f%0dSet-Cookie:crlf=injection%3bdomain=.ubnt.com%3b HTTP Response: HTTP/1.1 302 Found Content-Type: text/html; charset=iso-8859-1 Date: Thu, 16 Jun 2016 09:59:15 GMT Location: https://account-global.ubnt.com/index.html? = injection ...

Sucuri: [support.sucuri.net] CRLF Injection

PoC any browser except FireFox: http://support.sucuri.net/%23%0dSet-Cookie:crlf=injection;domain=.sucuri.net; HTTP Response: HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jun 2016 19:56:14 GMT Server: Apache Location: https://support.sucuri.net/ = injeciton \r...

Mail.ru: [sales.mail.ru] CRLF Injection

В разделе media портала sales.mail.ru существует редирект, который удаляет GET-параметры: GET https://sales.mail.ru/media/foo?bar 302 Moved Temporarily Location: http://sales.mail.ru/media/foo Он подвержен CRLF-инъекции, что позволяет атакующему внедрить произвольный заголовок в ответ сервера: GE...

Mail.ru: [torg.mail.ru] CRLF Injection

Редирект http://torg.mail.ru//foo → http://torg.mail.ru/foo подвержен CRLF-инъекции, что позволяет атакующему внедрить произвольный заголовок в ответ сервера. Пример установки значения куки для всего домена mail.ru: GET http://torg.mail.ru//xxx%0ASet-Cookie:test=test;domain=.mail.ru 301 Moved...

Sucuri: CRLF/HTTP header injection www.sucuri.net

I would like to report a security vulnerability on www.sucuri.net. The domain appears to be vulnerable for CRLF or HTTP header injection. This allows attackers to construct a URL that injects HTTP headers in the server's response. One of the things an attacker can do is injecting a "Set-Cookie"...

EMC RSA Authentication Manager CRLF Injection Vulnerability

RSA Authentication Manager: is the platform behind RSA SecurID, utilized to centrally manage the RSA SecurID environment, including authentication methods, users, applications, and agents, across multiple physical sites. A security vulnerability exists in RSA Authentication Manager versions prior...

CVE-2016-0902

CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-0902

CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-0902

CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-0902

EMC RSA Authentication Manager before 8.1 SP1 Patch 14 is affected by a CRLF injection vulnerability (CVE-2016-0902) that could allow an unauthenticated attacker to inject arbitrary HTTP headers and perform HTTP response splitting in unspecified vectors. Connected sources consistently identify th...

CVE-2016-2303

CRLF injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

Crlf injection

CRLF injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2016-2303

CRLF injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2016-2303

CVE-2016-2303: Ecava IntegraXor before 5.0 build 4522 is vulnerable to CRLF injection in HTTP headers, enabling HTTP response splitting via a crafted URL. Affected product: Ecava IntegraXor HMI web server (pre-5.0 build 4522). Root cause: improper neutralization of CRLF sequences in HTTP header h...

CVE-2016-3166

CRLF injection vulnerability in the drupalsetheader function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP...

CVE-2016-3166

CRLF injection vulnerability in the drupalsetheader function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP...