CVE-2010-2504

CVE-2010-2504 affects Splunk 4.0–4.0.10 and 4.1–4.1.1. The issue is HTTP header injection that allows remote authenticated users to obtain sensitive information (SPL-31066). Root cause details beyond “HTTP header injection” are not provided in the connected documents. Impact is noted as exposure ...

CVE-2010-2504

Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allows remote authenticated users to obtain sensitive information via HTTP header injection, aka SPL-31066...

Apache Axis 1.5 Session Fixation

===== Tempest Security Intelligence - Advisory 02 / 2010 =========== Vulnerability = 'Apache Axis Session Fixation Vulnerability' Authors = 'Tiago Ferreira ' 'Leandro Oliveira ' ======== Table of Contents =========================================== 1. Overview 2. Detailed description 3. Other...

SA-CONTRIB-2010-052 - Multiple vulnerabilities in multiple contributed modules

Versions affected and proposed solutions Private Message versions for the 5.x versions of Drupal The Privatemsg also known as Private Message module enables messages to be sent internally on a site. The module is vulnerable to cross-site request forgeries CSRF via it's message delete form. This...

Debian DSA-1950-1 : webkit - several vulnerabilities

Several vulnerabilities have been discovered in WebKit, a Web content engine library for Gtk+. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0945 Array index error in the insertItemBefore method in WebKit, allows remote attackers to execute...

cPanel - HTTP Response Splitting

cPanel - HTTP Response Splitting Recognize-Security - cPanel HTTP Response Splitting Vulnerability ----------------------------------------------------------------- Security Advisory by Trancer January 21 2010 http://www.rec-sec.com "Hacking, however, is an art, not a science." Vendor ------ cPan...

XOOPS Arbitrary File Deletion and HTTP Header Injection Vulnerabilities

XOOPS is prone to an HTTP-header-injection vulnerability and an arbitrary-file- deletion vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

openSUSE Security Update : bytefx-data-mysql (bytefx-data-mysql-173)

This patch fixes two security problems and one critical bug : Makes sure that values of all the tags which can be exploited are encoded to make sure no exploit is possible. CVE-2008-3422 A header injection problem in Sys.Web was fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

formmail 1.92 - Multiple Vulnerabilities

FormMail 1.92 Multiple Vulnerabilities Name Multiple Vulnerabilities in FormMail Systems Affected FormMail 1.92 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 4.3/10, vector: AV:N/AC:M/Au:N/C:P/I:N/A:N Vendor http://www.scriptarchive.com/formmail.html Advisory...

FormMail 1.92 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ============================================= FormMail 1.92 Multiple Remote Vulnerabilities ============================================= FormMail 1.92 Multiple Vulnerabilities Name Multiple Vulnerabilities in FormMail Systems Affected...

formmail 1.92 - Multiple Vulnerabilities

formmail 1.92 - Multiple Vulnerabilities FormMail 1.92 Multiple Vulnerabilities Name Multiple Vulnerabilities in FormMail Systems Affected FormMail 1.92 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 4.3/10, vector: AV:N/AC:M/Au:N/C:P/I:N/A:N Vendor...

LogMeIn 4.0.784 - cfgadvanced.html HTTP Header Injection

LogMeIn 4.0.784 - cfgadvanced.html HTTP Header Injection source: https://www.securityfocus.com/bid/35236/info LogMeIn is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input. By inserting arbitrary headers into an HTTP...

LogMeIn 4.0.784 - 'cfgadvanced.html' HTTP Header Injection

source: https://www.securityfocus.com/bid/35236/info LogMeIn is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input. By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks,...

CPCommerce 1.2.x - GLOBALS[prefix] Arbitrary File Inclusion

CPCommerce 1.2.x - GLOBALSprefix Arbitrary File Inclusion !/usr/bin/perl cpCommerce 1.2.x GLOBALSprefix Arbitrary File Inclusion Exploit by staker mail: stakerathotmaildotit url: http://cpcommerce.cpradio.org it works with registerglobals=on if you wanna carry out a LFI - mq=off short explanation...

Crlf injection

CRLF injection vulnerability in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the redirect parameter...

FormMail 1.92 XSS / HTTP Response Splitting

FormMail 1.92 Multiple Vulnerabilities Name Multiple Vulnerabilities in FormMail Systems Affected FormMail 1.92 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 4.3/10, vector: AV:N/AC:M/Au:N/C:P/I:N/A:N Vendor http://www.scriptarchive.com/formmail.html Advisory...

Web Mailer from CGI RESCUE vulnerable to HTTP header injection

Overview Web Mailer from CGI RESCUE contains a HTTP header injection vulnerability. Web Mailer from CGI RESCUE is a software that sends emails with contents that are input into a HTML form. Web Mailer contains a HTTP header injection vulnerability. This vulnerability has been fixed and an updated...

JVN#28020230 Web Mailer from CGI RESCUE vulnerable to HTTP header injection

Web Mailer from CGI RESCUE is a software that sends emails with contents that are input into a HTML form. Web Mailer contains a HTTP header injection vulnerability. Impact Falsified information may be displayed or an arbitrary script may be executed on the user's web browser. HTTP response...

Fedora 10 : rubygem-actionpack-2.1.1-2.fc10 (2009-2149)

CVE-2008-5189: CGI header injection vulnerability Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fujitsu Jasmine HTTP Response Splitting Vulnerability When Executing WebLink Template

Overview A vulnerability exists in Fujitsu Jasmine where HTTP response splitting may be conducted when the WebLink template is executed. Impact An attacker could insert arbitrary HTTP headers and launch HTTP response splitting attacks. Solution Please refer to the 'Vendor Information' section for...