phpLDAPadmin Local File Inclusion Vulnerability

phpLDAPadmin is a web-based LDAP client which is mainly used to manage LDAP servers. A local file inclusion vulnerability exists in the way the 'Accept-Language' HTTP header value is handled in versions of phpLDAPadmin prior to 0.9.8, which can be exploited by a remote attacker to cause a denial ...

DEBIAN-CVE-2011-4082

A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker could use this flaw to cause a denial of service via specially-crafted request...

The vulnerability of the AuthLDAPCharsetConfig component in the Apache HTTP Server allows a attacker to cause a service failure.

The vulnerability of the AuthLDAPCharsetConfig component in the Apache HTTP Server is related to writing beyond the buffer memory limit. Exploiting this vulnerability could allow a malicious actor to cause a service failure by using a specially crafted Accept-Language header...

CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

CVE-2015-9416

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

Design/Logic Flaw

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

CVE-2015-9416

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

CVE-2015-9416

CVE-2015-9416 affects the WordPress WPML plugin (sitepress-multilingual-cms) versions 2.9.3–3.2.6. Affected component: WPML; root cause: cross-site scripting via the Accept-Language HTTP header. Impact: allows execution of client-side code in victims’ browsers (XSS). Notable sources corroborate X...

LiveZilla Server Cross-Site Scripting Vulnerability (CNVD-2019-21246)

LiveZilla is a free online customer service system, based on PHP architecture, can run on Linux hosts or windows hosts, mainly divided into the client, server and server side LiveZilla Server. LiveZilla Server 8.0.1.1 before the version of mobile/index.php there is a cross-site scripting...

CVE-2019-12962

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...

CVE-2019-12962

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...

Design/Logic Flaw

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...

CVE-2019-12962

LiveZilla Server (8.0.1.0 and earlier) is vulnerable to a reflected XSS in mobile/index.php via the Accept-Language header (CVE-2019-12962). The issue allows injection of JavaScript, potentially exfiltrating session cookies or performing actions on behalf of the victim. Remediation: upgrade to th...

Denial Of Service (DoS)

Apache HTTPD modauthnzldap is vulnerable to denial of serviceDoS attacks if configured with AuthLDAPCharsetConfig. A remote user could send a specially crafted Accept-Language header value to trigger an out-of-bounds memory write error and potentially cause the target service to crash...

httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, modauthnzldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset...

httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, modauthnzldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset...

Cross-site Scripting (XSS)

tomcat-http is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the assumption that the Accept-Language header value received conforms to RFC 2616, allowing XSS attacks...

Learning With Texts 1.6.2 SQL Injection

Exploit Title: Learning with Texts 1.6.2 - 'start' SQL Injection Dork: N/A Date: 2018-10-18 Exploit Author: Ihsan Sencan Vendor Homepage: http://lwt.sourceforge.net/ Software Link: https://sourceforge.net/projects/lwt/files/latest/download Version: 1.6.2 Category: Webapps Tested on:...

GHSA-7MC5-CHHP-FMC3 Regular Expression Denial of Service in negotiator

Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value. Recommendation Update to version 0.6.1 or later...

DEBIAN-CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...