4826 matches found
CVE-2017-7459
ntopng before 3.0 is vulnerable to HTTP Response Splitting in HTTP responses. The CVE-2017-7459 entry documents this issue with a high impact (CVSS3 base 7.5) affecting network attack vector and high integrity impact. Exploitation details are not provided in the supplied sources. Remediation: upg...
CVE-2017-7459
ntopng before 3.0 allows HTTP Response Splitting...
CVE-2017-7459
Removed by vendor...
CVE-2017-7459: Improper Neutralization of Special Elements in Output Used by a Downstream Component
ntopng before 3.0 allows HTTP Response Splitting...
PT-2017-17752
Name of the Vulnerable Software and Affected Versions ntopng versions prior to 3.0 Description The issue allows HTTP Response Splitting. Recommendations For versions prior to 3.0, update to version 3.0 or later to resolve the issue...
OpenVPN Access Server 2.1.4 CRLF Injection
OpenVPN Access Server : CRLF injection with Session fixation Description OpenVPN Access Server is a full featured secure network tunneling VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client...
OpenVPN Access Server : CRLF injection with Session fixation(CVE-2017-5868)
Description OpenVPN Access Server is a full featured secure network tunneling VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client software packages that accommodate Windows, MAC, Linux, Android, a...
Cross site scripting
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...
CVE-2017-1291
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...
CVE-2017-1291
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...
CVE-2017-1291
IBM Maximo Asset Management 7.5 and 7.6 are vulnerable to HTTP response splitting via specially-crafted URLs, enabling potential web cache poisoning and cross-site scripting. Affected products include the core Maximo Asset Management 7.5/7.6 and related Industry Solutions and IBM Control Desk pro...
CVE-2017-5868
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...
PT-2017-12770
Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.5 through 7.6 Description The issue allows a remote attacker to exploit the system using specially-crafted URLs, potentially leading to HTTP response splitting attacks. This could enable the attacker to...
CVE-2017-1291: Improper Neutralization of Input During Web Page Generation
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...
CVE-2017-5868: Improper Neutralization of CRLF Sequences
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...
PT-2017-16721
Name of the Vulnerable Software and Affected Versions OpenVPN Access Server version 2.1.4 Description A CRLF injection issue in the web interface allows remote attackers to inject arbitrary HTTP headers, potentially leading to session fixation attacks and HTTP response splitting attacks. This is...
Ubiquiti Inc.: Directory traversal at https://nightly.ubnt.com
From within the http request function of the Acunetix and IronWasp programs I was able to view the passwd and hosts files at https://nightly.ubnt.com. Please see the attached screenshots for proof. I have tried to reproduce from within firefox and internet explorer without much luck however if yo...
McAfee Network Data Loss Prevention Information Disclosure Vulnerability (CNVD-2017-07548)
McAfee Network Data Loss Prevention is a data leakage protection solution. McAfee Network Data Loss Prevention NDLP has a Web server information leakage vulnerability in the server implementation, which can be exploited by remote attackers to exploit other vulnerabilities via the HTTP response...
Design/Logic Flaw
Web Server method disclosure in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote attackers to exploit and find another hole via HTTP response header...