CVE-2014-3069: Undefined Security Weakness

Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management SPM 6.0.5.5, when WebSphere Application Server is not used, allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecifie...

CVE-2014-3069

Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management SPM 6.0.5.5, when WebSphere Application Server is not used, allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecifie...

PT-2014-5062

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management SPM version 6.0.5.5 Description The issue affects the Universal Access component in IBM Curam Social Program Management, allowing remote authenticated users to inject arbitrary HTTP headers and conduct HTTP...

CVE-2014-3069

Summary: CVE-2014-3069 affects IBM Cúram Universal Access (V6.0.5.5) when not deployed on IBM WebSphere. The root cause is improper sanitization of user-supplied data output into HTTP response header fields, enabling CRLF injection and potential session/credential exposure or HTTP Response Splitt...

CVE-2014-3026

CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2014-3026

CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2014-3026

CVE-2014-3026 is a CRLF/header-injection vulnerability in IBM Maximo Asset Management 7.5.x (including Maximo Asset Management Essentials, various Maximo Industry Solutions, and SmartCloud Control Desk 7.5). The issue allows remote authenticated users to inject arbitrary HTTP headers and perform ...

CVE-2014-3026: Undefined Security Weakness

CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

PT-2014-5030

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.5 through 7.5.0.6 IBM Maximo Asset Management versions 7.5 through 7.5.0.3 IBM Maximo Asset Management versions 7.5.1 through 7.5.1.2 for SmartCloud Control Desk Description The issue allows remote...

CVE-2014-3427

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...

Crlf injection

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...

CVE-2014-3427

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...

CVE-2014-3427

CVE-2014-3427 affects Yealink VoIP Phones (validated on firmware 28.72.0.2) and arises from CRLF injection in the servlet handling the model parameter, enabling remote header injection and HTTP response splitting. Impact, as stated: arbitrary HTTP headers can be injected via the model parameter t...

PT-2014-5314

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phones version 28.72.0.2 Description A CRLF injection issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to the servlet endpoint. Recommendations For...

CVE-2014-3427: Undefined Security Weakness

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...

Frams&qt Fast File EXchange Multiple Vulnerabilities - Active Check

Frams&qt Fast File EXchange is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Factlink: XSS 01 on staging.fct.li

hey the error message generated can be used to escape out of a dynamically generated href link. The below will render in internet explorer without xss filter enabled of course. See the screenshot for an example. The response is: HTTP/1.1 504 Gateway Time-out Server: nginx/1.4.4 Date: Wed, 02 Jul...

PHPSysInfo 2.x Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/15396/info phpSysInfo is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. phpSysInfo is prone to cross-site scripting, HTTP...

DCP-Portal 3.7/4.x/5.x Calendar.PHP HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11340/info DCP-Portal is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled. A remo...

PHPWebSite 0.7.3/0.8.x/0.9.3 User Module HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11673/info A remote HTTP response splitting vulnerability reportedly affects phpWebSite in its user module. This issue is due to a failure of the application to properly sanitize user-supplied input. A remote attacker may...