CVE-2014-0230

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service thread consumption via a series of aborted uploa...

PT-2015-1604

Name of the Vulnerable Software and Affected Versions Cisco TelePresence TC versions 6.x through 6.3.3 Cisco TelePresence TC versions 7.x through 7.3.2 Description The issue is related to a CRLF injection vulnerability that exists due to insufficient input validation. This allows remote attackers...

php: HTTP response splitting in header() function

The header PHP function allowed header stings containing line break followed by a space or tab, as allowed by RFC 2616. Certain browsers handled the continuation line as new header, making it possible to conduct a HTTP response splitting attack against such browsers. The header function was updat...

Crlf injection

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

CVE-2015-0733

Cisco Headend System Release Digital Broadband Delivery System is affected by a CRLF injection vulnerability in the HTTP Header Handler, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response-splitting attacks (potentially enabling XSS). The issue, tracked as CVE-201...

CVE-2015-0733

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

PT-2015-4848

Name of the Vulnerable Software and Affected Versions Cisco Headend System Release affected versions not specified Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting XSS attacks via a crafted request...

CVE-2015-0733: Improper Neutralization of CRLF Sequences in HTTP Headers

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

Cisco Headend Digital Broadband Delivery System HTTP Response-Splitting Vulnerability

A vulnerability in the Cisco Headend Digital Broadband Delivery System could allow an unauthenticated, remote attacker to conduct HTTP response-splitting attacks. The vulnerability is due to improper sanitization on user input performed by the HTTP Header Handler within the affected software...

PT-2020-7833

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.12.12 Zend Framework 2.x versions prior to 2.3.8 Zend Framework 2.4.x versions prior to 2.4.1 Description: A CRLF injection vulnerability in ZendMail Zend Mail allows remote attackers to inject arbitrary HTT...

Fedora 21 : php-ZendFramework2-2.3.8-1.fc21 (2015-7687)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

SEC Consult SA-20150514-0 :: Multiple vulnerabilities in Loxone Smart Home (part 2)

SEC Consult Vulnerability Lab Security Advisory 20150514-0 ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware version 6.4.5.12 fixed version: 6.4.5.12 impact: Critical homepage:...

Loxone Smart Home XSS / DoS / Access Control

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware version 6.4.5.12 fixed version: 6.4.5.12 impact: Critical homepage: http://www.loxone.com...

Zend Framework HTTP Response Separation Vulnerability

Zend Framework ZF is an open source PHP5 development framework for developing web programs and services. An HTTP response separation vulnerability exists in Zend Framework due to the program failing to properly filter certain inputs. This allows an attacker to insert arbitrary HTTP headers and...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) due to headers overflow

Hi, I would like to report another HTTP Response Splitting vulnerability caused by header fields "overflow" that allows attackers to inject arbitrary headers in the response. Note that this issue is similar to 52042 but the root cause is different. Also, the below PoC is not the only affected pag...

Bsplayer 2.68 - HTTP Response Exploit (Universal) Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python ''' Bsplayer suffers from a buffer overflow vulnerability when processing the HTTP response when opening a URL. In order to exploit this bug I partially overwrited the seh record to land at pop pop ret instead of the full...

Bsplayer 2.68 - HTTP Response Universal

Bsplayer 2.68 - HTTP Response Universal !/usr/bin/python ''' Bsplayer suffers from a buffer overflow vulnerability when processing the HTTP response when opening a URL. In order to exploit this bug I partially overwrited the seh record to land at pop pop ret instead of the full address and then...

Bsplayer 2.68 - HTTP Response Universal

!/usr/bin/python ''' Bsplayer suffers from a buffer overflow vulnerability when processing the HTTP response when opening a URL. In order to exploit this bug I partially overwrited the seh record to land at pop pop ret instead of the full address and then used backward jumping to jump to a long...

SEC Consult SA-20150227-0 :: Multiple vulnerabilities in Loxone Smart Home

SEC Consult Vulnerability Lab Security Advisory 20150227-0 ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware: 5.49; Android-App: 3.4.1 fixed version: 6.3 impact: High homepage:...

NetCat CMS HTTP Response Splitting Vulnerability

NetCat CMS is a content management system. NetCat CMS suffers from a response splitting vulnerability that can be exploited by remote attackers to construct special responses that can be used in spoofing and forgery attacks to steal sensitive information...