D-Link Cookie command injection

Added: 07/30/2015 Background D-Link produces a variety of routers, switches, and other network equipment for home users and businesses. Problem A command injection vulnerability allows remote attackers to execute arbitrary commands by sending a specially crafted cookie in an HTTP request...

D-Link Cookie Command Injection Vulnerability

The D-Link DSP-W110A1FW105B01 is an outlet that controls the power switch wirelessly. A remote upload and code execution vulnerability exists in D-Link. When handling specially crafted cookie values, lighttpd's web server cookie handling command is injected...

Mail.ru: [s.mail.ru] CRLF Injection

Сценарий перенаправления с https://s.mail.ru/ на https://cloud.mail.ru/ уязвим к атаки типа CRLF Injection. PoC Установка cookie crlf=injection на .mail.ru Подвержены все браузеры, кроме FireFox https://s.mail.ru/test%0dSet-Cookie:crlf=injection;domain=.mail.ru; Может быть использовано в комбинац...

Cisco Conductor for Videoscape and Cisco Headend System Release Arbitrary Cookie Injection Vulnerabilities

Cisco Unified MeetingPlace is a multimedia conferencing solution. The solution provides a user environment that integrates voice, video and Web conferencing. A security vulnerability exists in Cisco Conductor for Videoscape and Cisco Headend System Release, where a remote attacker sends a special...

CVE-2015-0747

Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0076-1)

This update fixes the following security issues in MozillaFirefox : - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 bmo1109889, bmo1111737, bmo1026774, bmo1027300, bmo1054538, bmo1067473, bmo1070962, bmo1072130, bmo1072871, bmo1098583 Miscellaneous memory safety hazards rv:35.0 / rv:31.4 - MFSA...

Google Chrome < 41.0.2272.76 Multiple Vulnerabilities

Binary data 8684.pasl...

PYSEC-2015-17

The resolveredirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect...

openSUSE Security Update : chromium (openSUSE-2015-228)

Chromium was updated to 41.0.2272.76 bnc920825 Security fixes : - CVE-2015-1212: Out-of-bounds write in media - CVE-2015-1213: Out-of-bounds write in skia filters - CVE-2015-1214: Out-of-bounds write in skia filters - CVE-2015-1215: Out-of-bounds write in skia filters - CVE-2015-1216:...

openSUSE: Security Advisory for Security (openSUSE-SU-2015:0505-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update to Chromium 41.0.2272.76 (important)

Chromium was updated to 41.0.2272.76 bnc920825 Security fixes: CVE-2015-1212: Out-of-bounds write in media CVE-2015-1213: Out-of-bounds write in skia filters CVE-2015-1214: Out-of-bounds write in skia filters CVE-2015-1215: Out-of-bounds write in skia filters CVE-2015-1216: Use-after-free in v8...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) in report_story

Hi, I would like to report a HTTP Response Splitting vulnerability in https://twitter.com/i/safety/reportstory that allows attackers to inject arbitrary headers and contents in the response. PoC:...

Google Chrome Multiple Vulnerabilities-01 (Mar 2015) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CVE-2015-1229

net/http/proxyclientsocket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 aka Proxy Authentication Required HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response...

Code injection

net/http/proxyclientsocket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 aka Proxy Authentication Required HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response...

Google Chrome cookie injection attack vulnerability

Google Chrome is a popular WEB browser. A security vulnerability exists in the Google Chrome net/http/proxyclientsocket.cc file due to failure to properly handle the 407 aka Proxy Authentication Required HTTP status code that appears in the Set-Cookie header. A remote attacker can exploit this...

CVE-2015-1229

net/http/proxyclientsocket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 aka Proxy Authentication Required HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response...

CVE-2015-1229

Removed by vendor...

CVE-2015-1229

CVE-2015-1229 : Google Chrome before 41.0.2272.76 fails to properly handle a 407 (Proxy Authentication Required) response that includes a Set-Cookie header, enabling remote proxy servers to perform cookie-injection attacks. The vulnerability affects the net/http/proxy_client_socket.cc path and ca...

UBUNTU-CVE-2015-1229

net/http/proxyclientsocket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 aka Proxy Authentication Required HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response...