CVE-2023-38330

OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack...

PT-2023-26365 · Oxid · Oxid Eshop Enterprise Edition

Name of the Vulnerable Software and Affected Versions: OXID eShop Enterprise Edition versions 6.5.0 through 6.5.2 Description: The issue allows uploading files with modified headers in the administration area, enabling an attacker to create a HTTP Response Splitting attack by uploading a file wit...

Oxid Esales OXID eShop Code Issue Vulnerability

Oxid Esales OXID eShop is an online e-commerce platform from Oxid Esales, Germany. A security vulnerability exists in Oxid Esales OXID eShop Enterprise Edition prior to version 6.5.3 that originates from allowing the upload of a file with modified header information in the administration area. An...

CVE-2023-38330

OXID eShop Enterprise Edition 6.5.0–6.5.2 is affected by CVE-2023-38330 due to a vulnerability that allows uploading files with modified HTTP headers in the administration area, enabling a HTTP Response Splitting attack. The issue stems from the handling of uploaded files in versions prior to 6.5...

Security Bulletin: Netty is vulnerable to CVE-2022-41915 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses Netty which is vulnerable to CVE-2022-41915. Vulnerability Details CVEID:CVE-2022-41915 DESCRIPTION: Netty is vulnerable to HTTP response splitting attacks, caused by a flaw when calling DefaultHttpHeaders.set with an iterator of value...

Security Bulletin: Vulnerability in bottle-0.12.16 affects IBM Cloud Pak for Data System 1.0(CPDS 1.0) [CVE-2020-28473]

Summary The bottle-0.12.16 package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2020-28473. Vulnerability Details CVEID:CVE-2020-28473 DESCRIPTION: Bottle is vulnerable to HTTP response splitting attacks. A remote attacker...

Oracle Linux 8 : ruby:2.7 (ELSA-2023-3821)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3821 advisory. - Fix HTTP response splitting in CGI. Resolves: CVE-2021-33621 - Fix ReDoS vulnerability in URI. Resolves: CVE-2023-28755 - Fix ReDoS vulnerability in...

HTTP Response Splitting

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to HTTP Response Splitting. Go Vulnerability Report: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

ruby:2.7 security, bug fix, and enhancement update

ruby 2.7.8-139 - Upgrade to Ruby 2.7.8. Resolves: rhbz2149262 - Fix HTTP response splitting in CGI. Resolves: CVE-2021-33621 - Fix ReDoS vulnerability in URI. Resolves: CVE-2023-28755 - Fix ReDoS vulnerability in Time. Resolves: CVE-2023-28756 rubygem-abrt 0.4.0-1 - Update to abrt 0.4.0. Resolves...

CVE-2023-26137

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and...

Design/Logic Flaw

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and...

CVE-2023-26137

The CVE-2023-26137 entry concerns drogOnframework/drogon (C++) and describes an HTTP Response Splitting vulnerability. Untrusted user input used to build header values in addHeader/addCookie can inject CRLF sequences (\r\n) to terminate HTTP headers and inject malicious content. The threat is des...

CVE-2023-26137

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and...

CVE-2023-26137

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and...

Drogon 环境问题漏洞

Drogon is an open source HTTP application framework based on C++14/17. Drogon can be used to easily build various types of web application server programs using C++. Drogon is vulnerable to an environmental issue that stems from an HTTP response splitting problem that allows an attacker to add th...

PT-2023-20515 · Drogon · Drogon

Name of the Vulnerable Software and Affected Versions: drogonframework/drogon affected versions not specified Description: The issue arises when untrusted user input is used to build header values in the addHeader and addCookie functions, allowing an attacker to inject malicious content by adding...

AlmaLinux 8 : ruby:2.7 (ALSA-2023:3821)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3821 advisory. ruby/cgi-gem: HTTP response splitting in CGI CVE-2021-33621 ruby: ReDoS vulnerability in URI CVE-2023-28755 ruby: ReDoS vulnerability in Time CVE-2023-287...

Moderate: Red Hat Security Advisory: ruby:2.7 security, bug fix, and enhancement update

An update for the ruby:2.7 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 8 : ruby:2.7 (RHSA-2023:3821)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3821 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

ALSA-2023:3821 Moderate: ruby:2.7 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby 2.7. BZ2189465 Security Fixes: ruby/cgi-gem: HTTP response splitting i...