CVE-2017-6031

CVE-2017-6031 affects Certec EDV GmbH atvise scada pre-3.0. The issue is improper neutralization of HTTP headers for scripting syntax (header injection) that may enable remote code execution. Affected: atvise scada prior to version 3.0; exploitability is remotely possible. Mitigation: upgrade to ...

CVE-2017-6031: Improper Neutralization of HTTP Headers for Scripting Syntax

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution...

CVE-2017-6031

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution...

WordPress 2.3-4.8.3 - Host Header Injection in Password Reset

Description Attacker may be able to set the 'From' email header in password reset emails. PoC curl -H "Host: www.evil.com" --data "userlogin=adminto=&wp-submit;=Get+New+Password" http://example.com/wp-login.php?action=lostpassword...

openSUSE: Security Advisory for ruby2.1 (openSUSE-SU-2017:1128-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for ruby2.1 (important)

This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed: - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new"initialize" bsc1018808 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 - CVE-2015-3900: hostname validation does...

CVE-2017-2111

HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier,...

Design/Logic Flaw

HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier,...

CVE-2017-2111

CVE-2017-2111 describes an HTTP header injection vulnerability in specific I-O DATA network camera firmware. Affected products/versions include TS-WPTCAM (1.18 and earlier), TS-WPTCAM2 (1.00), TS-WLCE (1.18 and earlier), TS-WLC2 (1.18 and earlier), TS-WRLC (1.17 and earlier), TS-PTCAM (1.18 and e...

CVE-2017-2111: Improper Neutralization of CRLF Sequences

HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier,...

HTTP Header Injection

net/textproto in github.com/golang/go is vulnerable to HTTP header injection attacks. These attacks are possible because it treats spaces as hyphens. This leaves net/textproto vulnerable to request smuggling...

apt-cacher and apt-cacher-ng HTTP Response Splitting Vulnerability

apt-cacher is a set of software used to cache debian packages. apt-cacher-ng is an HTTP protocol proxy for Linux systems. An HTTP response splitting vulnerability exists in versions of apt-cacher before 1.7.15 and apt-cacher-ng before 3.4. An attacker can exploit this vulnerability to inject HTTP...

FreeBSD : codeigniter -- multiple vulnerabilities (df0144fb-295e-11e7-970f-002590263bf5)

The CodeIgniter changelog reports : Fixed a header injection vulnerability in common function setstatusheader under Apache thanks to Guillermo Caminer from Flowgate. Fixed byte-safety issues in Encrypt Library DEPRECATED when mbstring.funcoverload is enabled. Fixed byte-safety issues in Encryptio...

CVE-2016-4841: Improper Input Validation

Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers...

cgiemail and cgiecho Multiple Security Vulnerabilities (CVE-2017-5613)

SEC-212 Format string injection The ability to supply arbitrary format strings to cgiemail and cgiecho allowed code execution whenever a user was able to provide a cgiemail template file. Use CVE-2017-5613. SEC-214 Open redirect The cgiemail and cgiecho binaries served as an open redirect due to...

SUSE SLED12 / SLES12 Security Update : ruby2.1 (SUSE-SU-2017:1067-1)

This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed : - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new'initialize' bsc1018808 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 - CVE-2015-3900: hostname validation doe...

SUSE-SU-2017:1067-1 Security update for ruby2.1

This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed: - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new'initialize' bsc1018808 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 - CVE-2015-3900: hostname validation does...

Concrete5 8.x Header Injection and CSRF Vulnerability

Concrete5 CMS is prone to a header injection and cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Homebrew: Host header Injection

HI SECURITY TEAM Here is host header injection. Request changing host to www.google.com GET / HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 Windows NT 6.1; rv:24.0 Gecko/20100101 Firefox/24.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language:...

concrete5 Host Header Injection Vulnerability

concrete5 is a free content management system CMS developed by Portland Labs in the United States. A Host header injection vulnerability exists in concrete5, which allows an attacker to inject a malicious ip or domain name by modifying the Host header...