5731 matches found
CVE-2006-2943
Unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information...
CVE-2006-2944: Undefined Security Weakness
Unspecified vulnerability in CGI-RESCUE FORM2MAIL 1.21 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information...
CVE-2006-2943: Undefined Security Weakness
Unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information...
[SA20515] WebFORM and FORM2MAIL Mail Header Injection Vulnerability
---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...
Update Protection against Apache Header Injection Vulnerability
A flaw has been identified in Apache 1.3.34/2.0.57/2.2.1. The flaw specifically exists in the Expect header. Attackers can exploit This flaw by appending malformed Expect headers in outgoing HTTP requests and redirect users to Web sites of their choice...
FreeBSD : drupal -- multiple vulnerabilities (6779e82f-b60b-11da-913d-000ae42e9b93)
Drupal reports : Mail header injection vulnerability. Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Session fixation...
php security update
CentOS Errata and Security Advisory CESA-2006:0276 Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting...
security flaw
CRLF injection vulnerability in the mbsendmail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds LF in the "To" address argument...
[KAPDA::#34] - MyBB1.0.4~redirectfunction()~HeaderInjection
ORIGINAL ADVISORY: http://myimei.com/security/2006-03-10/mybb104redirectfunctionheaderinjection.html http://kapda.ir/advisory-295.html ——–Summary——– Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.0.4 Class: Remote Status: Unpatched Exploit: Not Available Solution: Availab...
CVE-2006-1225
CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy...
[DRUPAL-SA-2006-004] Drupal 4.6.6 / 4.5.8 fixes mail header injection issue
---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2006-004 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2006-004 Project: Drupal core Date: 2006-03-13 Security risk: moderately...
drupal -- multiple vulnerabilities
Drupal reports: Mail header injection vulnerability. Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Session fixation...
DRUPAL-SA-2006-004 Mail header injection vulnerability
Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Versions affected All Drupal versions before 4.6.6. Solution If you are runnin...
CVE-2006-0712
The CVE-2006-0712 issue affects Squishdot before 1.5.0 and its mail_html template, where improper validation of the (1) email and (2) title variables enables remote attackers to inject SMTP headers (likely via CRLF) and bypass spam filters. The root cause is input validation gaps in the mail_html...
CVE-2005-4712: Undefined Security Weakness
CRLF injection vulnerability in processsignup.php in PHP Handicapper allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the login parameter. NOTE: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include this issue as well...
[VulnWatch] XSS & Header Injection in Drupal and vBulletin
A fake image header with actual html body content was able to get past phpbb's input validation. An exploit was issued for phpbb a month ago and that sparked me to check some other webapps. vbulletin 3.5.0 forum file attachments did not sanitize against this, as a result Jelsoft quickly issued...
[SA17763] PHP "mb_send_mail()" "To:" Header Injection Vulnerability
TITLE: PHP "mbsendmail" "To:" Header Injection Vulnerability SECUNIA ADVISORY ID: SA17763 VERIFY ADVISORY: http://secunia.com/advisories/17763/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: PHP 4.4.x http://secunia.com/product/5768/ PHP...
CVE-2005-3633: Undefined Security Weakness
HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter...
[SA16270] UNG "name" and "email" Mail Header Injection
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...