CVE-2015-0733

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

CVE-2015-0733

Cisco Headend System Release Digital Broadband Delivery System is affected by a CRLF injection vulnerability in the HTTP Header Handler, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response-splitting attacks (potentially enabling XSS). The issue, tracked as CVE-201...

Fedora 22 : php-ZendFramework2-2.3.8-1.fc22 (2015-7708)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

[SECURITY] [DSA 3265-2] zendframework regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3265-2 [email protected] http://www.debian.org/security/ Alessandro Ghedini May 24, 2015 http://www.debian.org/security/faq -...

Debian DSA-3265-1 : zendframework - security update

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework. Except for CVE-2015-3154, all these issues were already fixed in the version initially shipped with Jessie. - CVE-2014-2681 Lukas Reschke reported a lack of protection against XML External Entity injection attacks in som...

[SECURITY] [DSA 3265-1] zendframework security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3265-1 [email protected] http://www.debian.org/security/ David Prévot May 20, 2015 http://www.debian.org/security/faq -...

DSA-3265-1 zendframework - security update

Bulletin has no description...

Fedora 21 : php-ZendFramework2-2.3.8-1.fc21 (2015-7687)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

Fedora 20 : php-ZendFramework2-2.3.8-1.fc20 (2015-7887)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Debian: Security Advisory (DSA-3265-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Erlang CRLF injection

CRLF injection in FTP commands...

Hippo CMS 7.9.7 Enterprise Edition CRLF Injection

Affected software: hippo cms Type of vulnerability:crlf URL:https://cms.demo.onehippo.com Discovered by: provensec Website: provensec.com version: CMS 7.9.7 Enterprise Edition Proof of concept payload : advanced%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) due to headers overflow

Hi, I would like to report another HTTP Response Splitting vulnerability caused by header fields "overflow" that allows attackers to inject arbitrary headers in the response. Note that this issue is similar to 52042 but the root cause is different. Also, the below PoC is not the only affected pag...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) in report_story

Hi, I would like to report a HTTP Response Splitting vulnerability in https://twitter.com/i/safety/reportstory that allows attackers to inject arbitrary headers and contents in the response. PoC:...

CRLF Injection Vulnerability in Multiple Sierra Wireless AirCard Products

The Sierra Wireless AirCard 760S, 762S and 763S are mobile broadband devices from Sierra Wireless Canada. A CRLF injection vulnerability exists in the export.cfg file in the web-based management console of multiple Sierra Wireless AirCard products. A remote attacker could exploit this vulnerabili...

CVE-2015-2054

CRLF injection vulnerability in export.cfg in the web-based administrative console for Sierra Wireless AirCard 760S, 762S, and 763S allows remote attackers to inject arbitrary headers via CRLF sequences in the save parameter...