CVE-2016-3114

Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access...

CVE-2016-3114

Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access...

CVE-2016-3691

Kallithea is affected by CVE-2016-3691. Before version 0.3.2, routes can bypass CSRF protection when using GET requests, enabling remote CSRF bypass. The issue is tied to Kallithea’s routing/CSRF handling, allowing an attacker to trigger state-changing actions via simple GET requests. Remediation...

CVE-2016-3114

CVE-2016-3114 affects Kallithea before 0.3.2. The vulnerability lets remote authenticated users edit or delete open pull requests or delete comments by abusing existing read access, due to insufficient access control validation. The issue is documented in multiple sources (NVD entry for CVE-2016-...

CVE-2016-3691

Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method...

Kallithea Design Vulnerability

Kallithea, a project under the US-based Software Freedom Conservancy organization, is a free source code management system. The system supports Mercurial and Git version control systems, hosting code, managing access control, and more. Kallithea suffers from a design vulnerability. An attacker ca...

Kallithea Elevation of Privilege Vulnerability

Kallithea, a project under the US-based Software Freedom Conservancy organization, is a free source code management system. The system supports Mercurial and Git version control systems, hosting code, managing access control, and more. Kallithea suffers from an elevation of privilege vulnerabilit...

Kallithea 'came_from' parameter HTTP Response Splitting Vulnerability

Kallithea is prone to http response splitting vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:kallithea:kallithea"...

Kallithea Remote Version Detection

Detects the installed version of Kallithea. This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Kallithea CRLF Injection Vulnerability

Kallithea is is a free source code management system. The Kallitheaadmin/login URI fails to adequately filter the 'namefrom' parameter, allowing remote attackers to exploit this vulnerability to inject arbitrary HTTP headers and perform HTTP response splitting attacks...

CVE-2015-5285

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

Crlf injection

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

PYSEC-2015-13

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

PYSEC-2015-13

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

CVE-2015-5285

CVE-2015-5285 affects Kallithea, a web-based source code management system. The vulnerability is a CRLF/HTTP header injection in the came_from parameter of the _admin/login page, enabling an attacker to inject arbitrary HTTP headers and perform HTTP response splitting. Documented affected version...

CVE-2015-5285

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

Kallithea 0.2.9 - came_from HTTP Response Splitting

Kallithea 0.2.9 - camefrom HTTP Response Splitting Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd,...

Kallithea 0.2.9 HTTP Response Splitting

Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd, Free Software source code management system that...

Kallithea 0.2.9 HTTP Response Splitting Vulnerability

Kallithea suffers from a HTTP header injection response splitting vulnerability because it fails to properly sanitize user input before using it as an HTTP header value via the GET 'camefrom' parameter in the login instance. This type of attack not only allows a malicious user to control the...

Kallithea 0.2.9 - 'came_from' HTTP Response Splitting

Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd, Free Software source code management system that...