PT-2025-4064 · Unknown +1 · Cpp-Httplib +1

Name of the Vulnerable Software and Affected Versions: cpp-httplib versions v0.17.3 through v0.18.3 Description: The issue allows attackers to exploit CRLF injection, which could lead to HTTP Response Splitting, XSS, and more, by not filtering CRLF characters r when those are prefixed with a null...

Advisory ROSA-SA-2025-2646

software: python2 2.7.18 WASP: ROSA-CHROME packageevrstring: python2-2.7.18-7 CVE-ID: CVE-2022-0391 BDU-ID: 2022-02302 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the urllib.parse module of the Python programming language interpreter is related to the non-neutralization of CRLF sequences...

CVE-2024-45687

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in Payara Platform Payara Server Grizzly, REST Management Interface modules, Payara Platform Payara Micro Grizzly modules allows Manipulating State, Identity Spoofing.This issue affects Payar...

CVE-2024-45687 HTTP Server incorrectly accepting disallowed characters within header values

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in Payara Platform Payara Server Grizzly, REST Management Interface modules, Payara Platform Payara Micro Grizzly modules allows Manipulating State, Identity Spoofing.This issue affects Payar...

BIT-PYTHON-MIN-2020-26116

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request...

PT-2025-3014 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.2.0 through 7.6.0 FortiProxy versions 7.2.0 through 7.4.5 Description: The issue is related to an improper neutralization of crlf sequences in http headers, also known as 'http response splitting'. This allows an...

File-Filter Bypass in Explicit Web Proxy Policy

...

GHSA-MGR7-5782-6JH9 The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package

Impact The Heartcore headless client library depends on Refit to assist in making HTTP requests to Heartcore public APIs. Refit recently published an advisory regarding a CRLF injection vulnerability whereby it is possible for a malicious user to smuggle additional headers or potentially body...

The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package

Impact The Heartcore headless client library depends on Refit to assist in making HTTP requests to Heartcore public APIs. Refit recently published an advisory regarding a CRLF injection vulnerability whereby it is possible for a malicious user to smuggle additional headers or potentially body...

Critical RCE Flaw in GFI KerioControl Allows Remote Code Execution via CRLF Injection

Threat actors are attempting to take advantage of a recently disclosed security flaw impacting GFI KerioControl firewalls that, if successfully exploited, could allow malicious actors to achieve remote code execution RCE. The vulnerability in question, CVE-2024-52875 , refers to a carriage return...

CLSA-2024-1735064231 Fix CVE(s): CVE-2024-11234

SECURITY UPDATE: Security vulnerability - debian/patches/CVE-2024-11234.patch: Fix stream HTTP fulluri CRLF injection issue - CVE-2024-11234...

CLSA-2024-1735046232 php: Fix of CVE-2024-11234

CVE-2024-11234: fix HTTP fulluri CRLF injection...

BIT-NODE-MIN-2023-23936 CRLF Injection in Nodejs ‘undici’ via host

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to...

BIT-NODE-MIN-2023-30589

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...

CLSA-2024-1734039943 php: Fix of CVE-2024-11234

CVE-2024-11234: fix stream HTTP fulluri CRLF injection...

php: Fix of CVE-2024-11234

CVE-2024-11234: fix stream HTTP fulluri CRLF injection...

[SECURITY] [DSA 5828-1] python-aiohttp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5828-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 11, 2024 https://www.debian.org/security/faq -...

SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2024:4215-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4215-1 advisory. - CVE-2024-11233: buffer overread when processing input with the convert.quoted-printable-decode filter. bsc1233702 -...

Vulnerabilities fixed in Mitel MiCollab

Mitel has fixed vulnerabilities in Mitel MiCollab Specifically the Unified Messaging and Conferencing components. The vulnerabilities are in the way Mitel MiCollab components handle user input. An attacker can exploit these vulnerabilities to gain unauthorized access to user data and system...

CVE-2024-48868

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...