PT-2019-8677

Name of the Vulnerable Software and Affected Versions Aterm W300P versions 1.0.13 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. Recommendations For Aterm W300P versions 1.0.13 and earlier, at the...

PT-2019-8680

Name of the Vulnerable Software and Affected Versions Aterm W300P versions 1.0.13 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary code via HTTP request and response due to a buffer overflow. Recommendations For versions 1.0.13 and earlier, updat...

CVE-2018-0629: Improper Neutralization of Special Elements used in an OS Command

Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response...

CVE-2018-0632: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response...

CVE-2018-16181: Improper Neutralization of CRLF Sequences in HTTP Headers

HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks that may result in an arbitrary script injection or setting an arbitrary cookie values via unspecified vectors...

CVE-2018-0628: Improper Neutralization of Special Elements used in an OS Command

Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response...

SUSE SLES12 Security Update : php5 (SUSE-SU-2018:0717-1)

This update for php5 fixes the following issues: Security issues fixed : - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the phpstreamurlwraphttpex bsc1083639. Note that Tenable Network Security has extracted the preceding description block directly from the...

IBM BigFix Platform 9.2.x < 9.2.15 / 9.5.x < 9.5.10 Multiple Vulnerabilities

According to its self-reported version, the IBM BigFix Platform application running on the remote host is 9.2.x prior to 9.2.15, or 9.5.x prior to 9.5.10. It is, therefore, affected by multiple vulnerabilities : - IBM BigFix Platform is vulnerable to HTTP response splitting attacks, caused by...

CVE-2018-17192

CVE-2018-17192 affects Apache NiFi where the X-Frame-Options headers were inconsistently applied on HTTP responses, leading to duplicate or missing security headers and potential clickjacking. The issue is documented across multiple sources, with mitigations indicating that a fix was applied in N...

CVE-2018-1474

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split respons...

Cross site scripting

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split respons...

CVE-2018-1474

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split respons...

CVE-2018-1474

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split respons...

CVE-2018-1474: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split respons...

Design/Logic Flaw

The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to...

CVE-2018-11347

The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to...

CVE-2018-11347

The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to...

CVE-2018-11347

The CVE-2018-11347 entry concerns the YunoHost web application (versions 2.7.2 through 2.7.14). Affected component/issue: HTTP Response Header Injection, enabling an attacker to inject one or more HTTP headers in server responses. Attack requirements: user interaction is needed (the attacker must...

PT-2018-10505

Name of the Vulnerable Software and Affected Versions YunoHost versions 2.7.2 through 2.7.14 Description The issue allows an attacker to inject one or several HTTP Header into the response from the server. This requires an interaction with the user to send them a malicious link. It could be used ...

RHEL 7 : nodejs and nodejs-tough-cookie (RHSA-2016:2101)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2101 advisory. Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private...