Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Overview Affected versions of this package are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the setheader and...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and inject...

Host Header Injection

lavalite/cms is vulnerable to host header injection.The vulnerability exists due to a lack of sanitization in the http header...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

Design/Logic Flaw

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

LavaLite cross-site scripting vulnerabilities

LavaLite is an open source lightweight content management system CMS. A security vulnerability exists in LavaLite CMS version v 9.0.0 that stems from vulnerability to host header injection attacks...

CVE-2023-27237

LavaLite CMS v9.0.0 is reported vulnerable to a host header injection attack. The root cause cited across multiple sources is insufficient sanitization of HTTP host headers, enabling manipulation that could affect request routing or cache behavior. No explicit exploit details or in‑the‑wild activ...

CVE-2023-27237

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

PT-2023-21020 · Unknown · Lavalite Cms

Name of the Vulnerable Software and Affected Versions: LavaLite CMS version 9.0.0 Description: The issue is related to a host header injection attack. This type of attack involves manipulating the host header in HTTP requests to potentially bypass security controls or access unauthorized resource...

CVE-2023-27237

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

CVE-2023-27237: Improper Neutralization of Input During Web Page Generation

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

CVE-2023-27237

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

CVE-2023-27237

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

Node.js: Fetch API did not protect against CRLF injection in host headers

A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection...

Node.js: Fetch API did not protect against CRLF injection in host headers

A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection...

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities

Summary Security vulnerabilities have been addressed in IBM Cognos Analytics 11.1.7 Fix Pack 7. These vulnerabilities have also been previously addressed in IBM Cognos Analytics 11.2.4 and 11.2.4 FP1. IBM WebSphere Liberty used in IBM Cognos Analytics is vulnerable to an HTTP Header Injection...

UBUNTU-CVE-2023-30536

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

Fortinet Fortigate Header injection in proxy login page (FG-IR-22-362)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-362 advisory. - A improper neutralization of crlf sequences in http headers 'http response splitting' in Fortinet FortiOS versions 7.2.0...

Slim psr7 security vulnerability

SLiM Simple Login Manager is a simple, lightweight and easily configurable login manager. A security vulnerability exists in Slim psr7 versions prior to 1.6.1, which originates from an attacker being able to include line breaks in header names and values...

CVE-2023-30536: Interpretation Conflict

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...