Crlf injection

A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF sequences into a URLRequest header value. When that request is sent via URLSession to an HTTP server,...

The vulnerability of Microsoft SharePoint Foundation, SharePoint Server, and SharePoint Enterprise Server lies in insufficient validation of input data, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft SharePoint Foundation, SharePoint Server, and SharePoint Enterprise Server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2022-3918

A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF sequences into a URLRequest header value. When that request is sent via URLSession to an HTTP server,...

CVE-2022-3918

A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF sequences into a URLRequest header value. When that request is sent via URLSession to an HTTP server,...

CVE-2022-3918

CVE-2022-3918 involves Swift’s FoundationNetworking (swift-corelibs-foundation). A CRLF injection flaw in URLRequest headers allows a client to insert CRLF sequences into a header value, which may cause the server to parse extra headers or a second request when sent via URLSession. The vulnerabil...

PT-2023-13704 · Apple · Swift-Corelibs-Foundation

Name of the Vulnerable Software and Affected Versions: swift-corelibs-foundation affected versions not specified Description: A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF injection in URLRequest headers. This allows a client to insert one or...

swift-corelibs-foundation 注入漏洞

Apple Swift is a programming language for macOS, iOS, watchOS, and tvOS from Apple USA. A security vulnerability exists in swift-corelibs-foundation versions prior to 5.7.3, which stems from the fact that programs using FoundationNetworking may be vulnerable to a CRLF injection attack in the...

CVE-2022-47195

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

CVE-2022-47197

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

CVE-2022-47194

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

Cross site scripting

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

Cross site scripting

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

CVE-2022-47197

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

CVE-2022-47197

CVE-2022-47197 affects Ghost Foundation Ghost 5.9.4. A stored XSS vulnerability exists in the codeinjection_foot of a post, allowing non-administrator users to inject arbitrary JavaScript which can escalate to administrator privileges when an admin visits the post. Triggered via an HTTP request i...

CVE-2022-47195

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

CVE-2022-47195

CVE-2022-47195 affects Ghost Foundation Ghost 5.9.4. The issue is an insecure default in Post Creation that allows non-administrator users to inject arbitrary JavaScript into posts, enabling privilege escalation to administrator via XSS. A stored XSS vulnerability is also described in the user’s ...

CVE-2022-47196

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

CVE-2022-47195

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...

CVE-2022-47196

CVE-2022-47196 affects Ghost Foundation Ghost 5.9.4. A stored XSS vulnerability exists in the post creation feature: non-administrator users can inject arbitrary JavaScript via the post’s codeinjection_head, potentially escalating privileges to administrator when an admin views the post. The issu...

CVE-2022-47196

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...