PHP 5.3.11/5.4.0RC2 - 'header()' HTTP Header Injection

source: https://www.securityfocus.com/bid/55297/info PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL. By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks...

Polipo 1.0.4.1 - POSTPUT HTTP Header Processing Denial of Service

Polipo 1.0.4.1 - POSTPUT HTTP Header Processing Denial of Service source: https://www.securityfocus.com/bid/49908/info Polipo is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Polipo 1.0.4...

Polipo 1.0.4.1 - POST/PUT HTTP Header Processing Denial of Service

source: https://www.securityfocus.com/bid/49908/info Polipo is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Polipo 1.0.4.1 is vulnerable; other versions may also be affected...

Mozilla Releases Field Guide to Do Not Track

Mozilla has released a comprehensive guide to the use and implementation of the Do Not Track technology that’s included in its Firefox browser, in an effort to give developers and advertisers a better handle on how the technology works and how users are taking advantage of it. The Do Not Track...

Spring Security - HTTP Header Injection

Spring Security - HTTP Header Injection source: https://www.securityfocus.com/bid/49535/info Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input. By inserting arbitrary headers into an HTTP response,...

Spring Security - HTTP Header Injection

source: https://www.securityfocus.com/bid/49535/info Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input. By inserting arbitrary headers into an HTTP response, attackers may be able to launch various...

ManageEngine ServiceDesk Plus Multiple Stored XSS Vulnerabilities

This host is running ManageEngine ServiceDesk Plus and is prone to multiple stored cross site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: secpodmanageengineservicedeskplusmultxssvuln.nasl 7006 2017-08-25 11:51:20Z teissa $ ManageEngine ServiceDesk Plus Multiple Stored XSS...

ManageEngine ServiceDesk Plus 8.0 Cross Site Scripting

ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT...

ManageEngine ServiceDesk Plus 8.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

ManageEngine ServiceDesk Plus 8.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary...

ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities

Exploit for jsp platform in category web applications ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help...

rubygem-rails -- multiple vulnerabilities

SecurityFocus reports: Ruby on Rails is prone to multiple vulnerabilities including SQL-injection, information-disclosure, HTTP-header-injection, security-bypass and cross-site scripting issues...

Cross site scripting

Cross-site scripting XSS vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository WSRR 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2011-1357

Technical details about CVE-2011-1357 are not publicly available in the provided connected documents. Monitor for updates from official advisories.

CVE-2011-1357

Cross-site scripting XSS vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository WSRR 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2011-1357: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository WSRR 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

Citrix Access Gateway Plug-in for Windows ActiveX Control Multiple Vulnerabilities (CTX129902)

The Citrix Access Gateway ActiveX control for Citrix Access Gateway Enterprise Edition is installed on the remote Windows host. It is the ActiveX component of the Citrix Access Gateway Plug-in for Windows and provides an SSL-based VPN via a web browser. The installed version of this control is...

Design/Logic Flaw

The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to validate signed DLLs by checking the certificate subject, not the signature, which allows man-in-the-middle attackers to...

CVE-2011-2882

CVE-2011-2882 pertains to a stack-based buffer overflow in the Citrix Access Gateway Plug-in for Windows ActiveX control (nsepa.ocx). Affected plug-in versions: 8.1-67.7, 9.0-70.5, and 9.1-96.4. The vulnerability occurs when processing certain HTTP header data, allowing remote code execution in t...

CVE-2011-2882

Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 allows remote attackers to execute arbitrary code via crafted HTTP header data...

CVE-2011-2883

The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to validate signed DLLs by checking the certificate subject, not the signature, which allows man-in-the-middle attackers to...