936 matches found
Smart Heat Temperature Control App for Android suffers from an override access vulnerability
Smart Heat Temperature Control APP a home temperature control software, users only need to add the home's Internet-accessible thermostat to the software, you can use your phone or tablet to control the temperature of your home's HVAC equipment. The Android version of Smart Heat Temperature Contro...
Cross site scripting
A vulnerability in the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this...
CVE-2017-12309
A vulnerability in the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this...
CVE-2017-12309
The CVE-2017-12309 issue affects Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA). The root cause is improper input sanitization that enablesHTTP response splitting by an unauthenticated remote attacker, allowing potential cross-site scripting, cross-user defac...
Cisco Email Security Appliance and Content Security Management Appliance HTTP Response Splitting Vulnerability
A vulnerability in the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA software could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly...
CVE-2017-3165
In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...
OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)
It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with...
IBM Tivoli Storage Manager Client Symlink Cross-User Information Disclosure
The version of IBM Tivoli Storage Manager Client installed on the remote Linux host is 5.5.x prior to 6.3.2.6, 6.4.x prior to 6.4.3.3, or 7.1.x prior to 7.1.6. It is, therefore, affected by an information disclosure vulnerability due to creating temporary files insecurely. A local attacker can...
EMC Data Domain Insecure Password Reset Vulnerability
EMC Data Domain systems are data protection storage solutions. EMC Data Domain versions 5.4, 5.5, 5.6, and 5.7 have a security vulnerability that could allow users to change their passwords without having to provide their current passwords, or even change the passwords of other users in the same...
Shopify: HTTP-Response-Splitting on v.shopify.com
I discovered a HTTP-Response-Splitting issue on v.shopify.com Steps to reproduce: Call the following URL in any browser and catch the response e.g. with burp...
PT-2014-8628 · Citrix · Citrix Netscaler Application Delivery Controller +1
Name of the Vulnerable Software and Affected Versions: Citrix NetScaler Application Delivery Controller and NetScaler Gateway versions 10.5.50.10 through 10.5-52.10 Citrix NetScaler Application Delivery Controller and NetScaler Gateway versions 10.1.122.17 through 10.1-129.10 Citrix NetScaler...
HTTP Protocol header injection vulnerability-vulnerability warning-the black bar safety net
HTTP response header file contains unverified data will lead to cache-poisoning, cross-site scripting, cross-user defacement, page hijacking, cookie manipulation or open redirect. HTTP Protocol header injection vulnerability principles The following cases will appear in the HTTP Protocol header...
Mobile Mp3 Search Engine HTTP Response Splitting
-=--------------------ADVISORY-------------------=- Mobile Mp3 Search Engine 2.0 Author: Corrado Liotta Aka CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Mobile Mp3 Search Engine -=+ Version: 2.0 -=+ Vendor's URL:...
Apache TomCat mod_jk < 1.2.27 Cross-user Information Disclosure
Binary data 4984.prm...
SnipSnap: HTTP response splitting
Background SnipSnap is a user friendly content management system with features such as wiki and weblog. Description SnipSnap contains various HTTP response splitting vulnerabilities that could potentially compromise the sites data. Some of these attacks include web cache poisoning, cross-user...