YOPMail XSS / Injection / HTTP Response Splitting

YOPMAILAnonymous&Free email address CRLF Injection-HTTP Response Spliting/XSS/Session Token in URL ================================================================================================================================================== Report-Timeline: ================ 2013-06-01:...

PT-2014-2342

Name of the Vulnerable Software and Affected Versions Dancer versions prior to 1.3114 Description A CRLF injection vulnerability exists in the cookie method of Dancer, allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name...

hash_analysis

This plugin identifies hashes in HTTP responses. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand exactly whats under the hood: Plugin source code...

http_in_body

This plugin searches for HTTP responses that contain other HTTP request/responses in their response body. This situation is mostly seen when programmers enable some kind of debugging for the web application, and print the original request in the response HTML as a comment. Plugin type Grep Option...

strange_reason

Analyze HTTP response reason messages sent by the remote web application and report uncommon findings. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand...

strange_http_codes

Analyze HTTP response codes sent by the remote web application and report uncommon findings. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand exactly...

Crlf injection

CRLF injection vulnerability in IBM WebSphere Portal 6.1.0.x before 6.1.0.3 CF26, 6.1.5.x before 6.1.5 CF26, 7.0.0.x before 7.0.0.2 CF21, and 8.0.0.x through 8.0.0.1 CF5, when home substitution aka uri.home.substitution is enabled, allows remote authenticated users to inject arbitrary HTTP header...

CVE-2013-2950

CRLF injection vulnerability in IBM WebSphere Portal 6.1.0.x before 6.1.0.3 CF26, 6.1.5.x before 6.1.5 CF26, 7.0.0.x before 7.0.0.2 CF21, and 8.0.0.x through 8.0.0.1 CF5, when home substitution aka uri.home.substitution is enabled, allows remote authenticated users to inject arbitrary HTTP header...

PT-2013-4057

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 6.1.0.x through 6.1.0.2, IBM WebSphere Portal versions 6.1.5.x through 6.1.5.25, IBM WebSphere Portal versions 7.0.0.x through 7.0.0.1, IBM WebSphere Portal versions 8.0.0.x through 8.0.0.1 Description The issue...

CVE-2013-2950: Improper Control of Generation of Code

CRLF injection vulnerability in IBM WebSphere Portal 6.1.0.x before 6.1.0.3 CF26, 6.1.5.x before 6.1.5 CF26, 7.0.0.x before 7.0.0.2 CF21, and 8.0.0.x through 8.0.0.1 CF5, when home substitution aka uri.home.substitution is enabled, allows remote authenticated users to inject arbitrary HTTP header...

PT-2013-3648

Name of the Vulnerable Software and Affected Versions Sleipnir Mobile application versions 2.8.0 and earlier Sleipnir Mobile Black Edition application versions 2.8.0 and earlier Description The issue allows remote attackers to load arbitrary Extension APIs, and trigger downloads or obtain sensiti...

[Wireshark v1.9.2] World’s Foremost Network Protocol Analyzer

Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto and often de jure standard across many industries and educational institutions. Wireshark development thrives thanks to the...

Portal Web Services CRLF Injection / XSS

Exploit Title: Portal Web Services Cms CRLF injection + Cross Site Scripting Vulnerability + Exploit Author: Ashiyane Digital Security Team + Home : www.Ashiyane.org + Vendor Homepage: www.portalwebservices.com + Tested on: Windows 7 + Dork: intext:"Powered By : Portal Web Services"...

DHS, ICS-CERT Warn of Siemens HMI Vulnerabilities

The Department of Homeland Security and the ICS-CERT issued an advisory yesterday warning of serious vulnerabilities in Siemens industrial control software deployed in a number of industries including water, gas and oil, and chemical. Siemens said it has patched the flaws in a new version of its...

CVE-2013-0670

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

Crlf injection

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2013-0670

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2013-0670

Siemens WinCC (TIA Portal) 11 HMI Web application is affected by CVE-2013-0670 (CRLF injection). A crafted URL can lead to HTTP header injection and HTTP response splitting via the HMI Web server. Public sources (NVD, Red Hat cve page, ICS-CERT advisory) confirm the vulnerability in WinCC V11 and...

PT-2013-2515

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue concerns a CRLF injection vulnerability in the HMI web application. This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attac...

CVE-2013-0670: Improper Input Validation

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...