895 matches found
HTTP header injection using line breaks
More info at https://www.drupal.org/SA-CORE-2016-001...
HTTP header injection using line breaks
More info at https://www.drupal.org/SA-CORE-2016-001...
JVN#54686544: HOME SPOT CUBE multiple vulnerabilities
HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains multiple vulnerabilities listed below. Cross-site scripting - CVE-2016-1136 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N| Base Score: 4.3 CVSS v2|...
CVE-2016-1899
CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting XSS attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit....
LiteSpeed Web Server 5.1.0 HTTP Header Injection
Information -------------------- Advisory by Netsparker Name: HTTP Header Injection in LiteSpeed Web Server Affected Software : LiteSpeed Web Server Affected Versions: v5.1.0 and possibly below Vendor Homepage : https://www.litespeedtech.com/ Vulnerability Type : HTTP Header Injection Severity :...
JVN#45928828: H2O vulnerable to HTTP header injection
H2O is an open source web server software. H2O contains an HTTP header injection vulnerability. Impact An HTTP response splitting attack may result in arbitrary cookie values. Solution Update the Software Update to the latest version according to the information provided by the developer. Product...
CVE-2015-5245
CRLF injection vulnerability in the Ceph Object Gateway aka radosgw or RGW in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name...
Google Golang Go HTTP Header Injection Vulnerability
Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. An HTTP header injection vulnerability exists in Google Golang Go. An attacker can exploit this vulnerability to inject arbitrary HTTP headers into the server response, bypass...
HackerOne: HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com
The subdomain info.hackerone.com is vulnerable to HTTP header injection. I'm aware that you are only interested in critical issues affecting this subdomain. However, you may be interested in this issue as a vulnerability in this domain may affect the domain hackerone.com. The vulnerability is a...
PT-2016-12: HTTP Header Injection in VMware vCenter Server and ESXi
The specialists of the Positive Research center have detected an HTTP Header Injection vulnerability in VMware vCenter Server and ESXi. The application does not properly sanitize user input before using it in HTTP response headers that allows a malicious user to inject arbitrary headers into HTTP...
Kallithea 0.2.9 HTTP Response Splitting
Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd, Free Software source code management system that...
Kallithea 0.2.9 HTTP Response Splitting Vulnerability
Kallithea suffers from a HTTP header injection response splitting vulnerability because it fails to properly sanitize user input before using it as an HTTP header value via the GET 'camefrom' parameter in the login instance. This type of attack not only allows a malicious user to control the...
Kallithea 0.2.9 - came_from HTTP Response Splitting
Kallithea 0.2.9 - camefrom HTTP Response Splitting Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd,...
Kallithea 0.2.9 - 'came_from' HTTP Response Splitting
Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd, Free Software source code management system that...
Apache Cordova plugin cordova-plugin-file-transfer vulnerable to HTTP header injection
Overview cordova-plugin-file-transfer, a plugin for Apache Cordova provided by the Apache Software Foundation, provides functionality to upload and download files in applications created by Apache Cordova. It also provides functionality to add HTTP headers. Android applications that use...
Netgear Prosafe VPN Firewalls - Multiple vulnerabilities
About Encripto AS ================= Encripto is a Norwegian company which provides specialized services within IT-security. Our core expertise is security testing, network security monitoring and training. Encripto is committed to information security. We do research to discover trends, new...
Cisco Web Security Appliance Web Framework HTTP Header Injection Vulnerability
A vulnerability in the web framework of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could introduce arbitrary code into the web interface. The vulnerability is due to insufficient validation of user input before it is used...
CVE-2015-0770
The vulnerability CVE-2015-0770 affects Cisco TelePresence TC software on the SX20 Integrator C platform, specifically TC 6.x before 6.3.4 and 7.x before 7.3.3. The root cause is improper handling of HTTP requests leading toCRLF injection and HTTP response splitting, allowing an unauthenticated, ...
Squid < 3.1.1 HTTP Header Injection
Binary data 8698.prm...
Cisco Ironport AsyncOS HTTP Header Injection Vulnerability
Cisco Ironport AsyncOS suffers from an HTTP header injection vulnerability. Cisco Ironport AsyncOS HTTP Header Injection Vendor: Cisco Product webpage: http://www.cisco.com Affected versions: Cisco Ironport ESA - AsyncOS 8.0.1-023 Cisco Ironport WSA - AsyncOS 8.5.5-021 Cisco Ironport SMA - AsyncO...