Updated nodejs packages fix security vulnerability

Node.js has a defect that may make HTTP response splitting possible under certain circumstances. If user-input is passed to the reason argument to writeHead on an HTTP response, a new-line character may be used to inject additional responses CVE-2016-5325. The tls.checkServerIdentity function in...

MGASA-2017-0204 Updated nodejs packages fix security vulnerability

Node.js has a defect that may make HTTP response splitting possible under certain circumstances. If user-input is passed to the reason argument to writeHead on an HTTP response, a new-line character may be used to inject additional responses CVE-2016-5325. The tls.checkServerIdentity function in...

U.S. Dept Of Defense: CRLF Injection on ███████

Summary: The web application hosted on the "█████" domain is affected by a carriage return line feeds CRLF injection vulnerability that could be used in combination with others. This issue could allow XSS via Cookie, bypass Double Submit Cookie csrf protection or Session Fixation on .█████████...

The vulnerability of the FFmpeg multimedia library’s component allows a hacker to execute arbitrary code.

The vulnerability of the FFmpeg multimedia library’s component is caused by an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using data with incorrect size in the HTTP response...

CVE-2017-7459

ntopng before 3.0 allows HTTP Response Splitting...

Design/Logic Flaw

ntopng before 3.0 allows HTTP Response Splitting...

CVE-2017-7459

ntopng before 3.0 allows HTTP Response Splitting...

CVE-2017-7459

ntopng before 3.0 allows HTTP Response Splitting...

CVE-2017-7459

ntopng before 3.0 allows HTTP Response Splitting...

CVE-2017-7459

ntopng before 3.0 is vulnerable to HTTP Response Splitting in HTTP responses. The CVE-2017-7459 entry documents this issue with a high impact (CVSS3 base 7.5) affecting network attack vector and high integrity impact. Exploitation details are not provided in the supplied sources. Remediation: upg...

CVE-2017-7459

Removed by vendor...

OpenVPN Access Server 2.1.4 CRLF Injection

OpenVPN Access Server : CRLF injection with Session fixation Description OpenVPN Access Server is a full featured secure network tunneling VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client...

OpenVPN Access Server : CRLF injection with Session fixation(CVE-2017-5868)

Description OpenVPN Access Server is a full featured secure network tunneling VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client software packages that accommodate Windows, MAC, Linux, Android, a...

Cross site scripting

IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...

CVE-2017-1291

IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...

CVE-2017-1291

IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...

CVE-2017-1291

IBM Maximo Asset Management 7.5 and 7.6 are vulnerable to HTTP response splitting via specially-crafted URLs, enabling potential web cache poisoning and cross-site scripting. Affected products include the core Maximo Asset Management 7.5/7.6 and related Industry Solutions and IBM Control Desk pro...

CVE-2017-5868

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...

Ubiquiti Inc.: Directory traversal at https://nightly.ubnt.com

From within the http request function of the Acunetix and IronWasp programs I was able to view the passwd and hosts files at https://nightly.ubnt.com. Please see the attached screenshots for proof. I have tried to reproduce from within firefox and internet explorer without much luck however if yo...

McAfee Network Data Loss Prevention Information Disclosure Vulnerability (CNVD-2017-07548)

McAfee Network Data Loss Prevention is a data leakage protection solution. McAfee Network Data Loss Prevention NDLP has a Web server information leakage vulnerability in the server implementation, which can be exploited by remote attackers to exploit other vulnerabilities via the HTTP response...