CVE-2017-1000247

CVE-2017-1000247 affects CodeIgniter 3.1.3 with an HTTP header injection vulnerability in set_status_header() under Apache. Root cause is injection via header handling in that function, leading to header manipulation. A patch is available in CodeIgniter 3.1.4 (see changelog link). If using 3.1.3,...

CVE-2017-1000247

British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the setstatusheader common function under Apache resulting in HTTP Header Injection flaws...

CVE-2017-1000247: Improper Input Validation

British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the setstatusheader common function under Apache resulting in HTTP Header Injection flaws...

PT-2017-10940

Name of the Vulnerable Software and Affected Versions CodeIgniter version 3.1.3 Description The issue concerns HTTP Header Injection in the set status header common function under Apache, resulting in HTTP Header Injection flaws. Recommendations For CodeIgniter version 3.1.3, update to a newer...

CVE-2017-12309

A vulnerability in the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this...

Debian DSA-4015-1 : openjdk-8 - security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in impersonation of Kerberos services, denial of service, sandbox bypass or HTTP header injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

EulerOS 2.0 SP1 : java-1.8.0-openjdk (EulerOS-SA-2017-1254)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple flaws were discovered in the RMI and Hotspot components in OpenJDK. An untrusted Java application or applet could use these...

OpenJDK: HTTP client insufficient check for newline in URLs (Networking, 8176751)

It was found that the HttpURLConnection and HttpsURLConnection classes in the Networking component of OpenJDK failed to check for newline characters embedded in URLs. An attacker able to make a Java application perform an HTTP request using an attacker provided URL could possibly inject additiona...

Linksys Devices Multiple Vulnerabilities

Multiple Linksys devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:linksys:";...

Linksys E Series - Multiple Vulnerabilities

Exploit for hardware platform in category web applications ======================================================================= title: Multiple vulnerabilities product: Linksys E series, see "Vulnerable / tested versions" vulnerable version: see "Vulnerable / tested versions" fixed version: no...

Linksys E Series - Multiple Vulnerabilities

Linksys E Series - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Linksys E series, see "Vulnerable / tested versions" vulnerable version: see "Vulnerable /...

Linksys E Series - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Linksys E series, see "Vulnerable / tested versions" vulnerable version: see "Vulnerable / tested versions" fixed version: no public fix...

Moxa AWK-3131A Web Application bkpath HTTP Header Injection Vulnerability(CVE-2016-8720)

Summary An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted HTTP request can inject a payload in the bkpath parameter which will be copied in to Location header of the...

MGASA-2017-0325 Updated rt/perl-Encode packages fix security vulnerability

RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket CVE-2012-4733. RT 3.8.0 and above include a version of bin/rt th...

CVE-2015-1445

HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...

CVE-2015-1445

CVE-2015-1445 affects the fli4l httpd component. The connected documents confirm an HTTP header injection vulnerability in the httpd package for fli4l before 3.10.1 and in version 4.0 before 2015-01-30. The CVSS metrics indicate a NETWORK-exposed issue with HIGH severity (CVSS v3.0: AV:N/AC:L/PR:...

CVE-2015-1445: Improper Neutralization of CRLF Sequences in HTTP Headers

HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...

PT-2017-6491

Name of the Vulnerable Software and Affected Versions fli4l versions prior to 3.10.1 fli4l versions 4.0 before 2015-01-30 Description The issue concerns HTTP header injection in the httpd package. Recommendations For fli4l versions prior to 3.10.1, update to version 3.10.1 or later. For fli4l...

PT-2017-6364

Name of the Vulnerable Software and Affected Versions IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware versions prior to 3.4.1110 Description The issue allows remote attackers to inject arbitrary HTTP headers, which can lead to HTTP response splitting attacks. This...

GNU Wget: Header injection

Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description It was discovered that there was a header injection vulnerability in GNU Wget which allowed remote attackers to inject arbitrary HTTP headers via CRL...