CMS Made Simple 1.12.1 2.1.3 - Web Server Cache Poisoning

CMS Made Simple 1.12.1 2.1.3 - Web Server Cache Poisoning ============================================= Web Server Cache Poisoning in CMS Made Simple ============================================= CVE-2016-2784 Product Description =================== CMS Made Simple is a great tool with many plugi...

CMS Made Simple Cache Poisoning

============================================= Web Server Cache Poisoning in CMS Made Simple ============================================= CVE-2016-2784 Product Description =================== CMS Made Simple is a great tool with many plugins to publish content on the Web. It aims to be simple to...

Updated varnish packages fix CVE-2015-8852

Updated varnish packages fix security vulnerabilities: Régis Leroy from Makina Corpus discovered that varnish, a caching HTTP reverse proxy, is vulnerable to HTTP smuggling issues, potentially resulting in cache poisoning or bypassing of access control policies CVE-2015-8852...

MGASA-2016-0150 Updated varnish packages fix CVE-2015-8852

Updated varnish packages fix security vulnerabilities: Régis Leroy from Makina Corpus discovered that varnish, a caching HTTP reverse proxy, is vulnerable to HTTP smuggling issues, potentially resulting in cache poisoning or bypassing of access control policies CVE-2015-8852...

Debian DSA-3553-1 : varnish - security update

Regis Leroy from Makina Corpus discovered that varnish, a caching HTTP reverse proxy, is vulnerable to HTTP smuggling issues, potentially resulting in cache poisoning or bypassing of access control policies. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

[SECURITY] [DSA 3553-1] varnish security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3553-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 22, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3553-1 (varnish - security update)

Regis Leroy from Makina Corpus discovered that varnish, a caching HTTP reverse proxy, is vulnerable to HTTP smuggling issues, potentially resulting in cache poisoning or bypassing of access control policies. OpenVAS Vulnerability Test $Id: deb3553.nasl 6608 2017-07-07 12:05:05Z cfischer $...

Debian: Security Advisory (DSA-3553-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

New Relic: Host Header Injection / Cache Poisoning

The application reflects HTTP Header value back in it's response and it may be possible to poison the server cache. The X-Forwarded-Host is directly reflected as a hyperlink. HTTP Request GET / HTTP/1.1 Host: newrelic.com X-Forwarded-Host: pavanw3b.com ... .... HTTP Response HTTP/1.1 200 OK...

IBM WebSphere Application Server CRLF Injection Vulnerability (Feb 2016)

IBM WebSphere Application Server is prone to a CRLF injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Critical iOS Flaw allowed Hackers to Steal Cookies from Devices

Apple has patched a critical vulnerability in its iOS operating system that allowed criminal hackers to impersonate end users' identities by granting read/write access to website's unencrypted authentication cookies. The vulnerability was fixed with the release of iOS 9.2.1 on Tuesday, almost thr...

Shopify: HTTP-Response-Splitting on v.shopify.com

I discovered a HTTP-Response-Splitting issue on v.shopify.com Steps to reproduce: Call the following URL in any browser and catch the response e.g. with burp...

Google Golang Go HTTP Header Injection Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. An HTTP header injection vulnerability exists in Google Golang Go. An attacker can exploit this vulnerability to inject arbitrary HTTP headers into the server response, bypass...

CVE-2008-3437

OpenOffice.org OOo before 2.1.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3440

Sun Java 1.6.003 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

Apache cordova-plugin-file-transfer HTTP header injection vulnerability

Apache Cordova is the Apache Software Foundation's platform for developing mobile applications using HTML, CSS, and JavaScript, and is the core engine that drives PhoneGap the development framework. Apache cordova-plugin-file-transfer is a file transfer plugin. a file-transfer plugin. An HTTP...

FreeBSD : codeigniter -- multiple vulnerabilities (c21f4e61-6570-11e5-9909-002590263bf5)

The CodeIgniter changelog reports : Security: Added HTTP 'Host' header character validation to prevent cache poisoning attacks when baseurl auto-detection is used. Security: Added FSCommand and seekSegmentTime to the 'evil attributes' list in CISecurity::xssclean. %NASLMINLEVEL 70300 C Tenable...

X (Formerly Twitter): XSS and cache poisoning via upload.twitter.com on ton.twitter.com

Hi, I would like to report an issue where attackers can bypass the upload restriction on upload.twitter.com to cause XSS on ton.twitter.com and cache poisoning. Detail When using upload.twitter.com to upload audience data, it checks if the file type is allowed and rejects any harmful files e.g...

Apache HTTP Server Multiple Vulnerabilities (Aug 2015) - Windows

Apache HTTP Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:httpserver";...

Google Golang Go HTTP Header Injection Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems. Google Golang Go suffers from an HTTP header injection vulnerability that could be exploited by remote attackers to inject HTTP headers into the server response, spoof the target user,...