Crlf injection

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

CVE-2017-8791

CVE-2017-8791 affects Accellion FTA devices prior to FTA_9_12_180. The vulnerability is a CRLF injection in the login page parameter path: home/seos/courier/login.html auth_params, allowing a remote attacker to trigger a CRLF-based attack. Public sources in CNVD/NVD confirm a remote-exploitation ...

CVE-2017-8788

CVE-2017-8788 affects Accellion FTA devices prior to FTA_9_12_180. A CRLF injection vulnerability exists in settings_global_text_edit.php that enables newline/CRLF payloads (e.g., ?display=x%0Dnewline) and, per CNVD/NVD records, can allow remote command execution. Impact details in the connected ...

CVE-2017-8788

An issue was discovered on Accellion FTA devices before FTA912180. There is a CRLF vulnerability in settingsglobaltextedit.php allowing ?display=x%0Dnewline attacks...

Pornhub: DOM-based XSS on youporn.com (main page)

The researcher found a DOM-based XSS on the youporn.com main page. The malicious input could be injected into JS comment section //jscomment. Using CRLF %0d%0a in the , it was possible to escape from JS comment section, and execute arbitrary JavaScript. Simple alert box, and crossdomain request...

httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir

It was found that Apache was vulnerable to a HTTP response splitting attack for sites which use moduserdir. An attacker could use this flaw to inject CRLF characters into the HTTP header and could possibly gain access to secure data...

Computer Associates (Layer7) API Gateway 7 / 8 / 9 CRLF Response Splitting / Directory Traversal

https://www.osisecurity.com.au/computer-associates-api-gateway-crlf-response-splitting-directory-traversal-vulnerabilities.html Date: 04-Apr-2017 Product: Computer Associates Layer7 API Gateway Versions affected: v7, v8, v9 Vulnerabilities: 1 CRLF Response Splitting...

Trend Micro InterScan Web Security Virtual Appliance transparent_setting CRLF Injection Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within transparentsetting. The issue results from the lac...

HackerOne: CRLF injection in info.hacker.one

Vulnerable URL: info.hacker.one Vulnerability description This script is possibly vulnerable to CRLF injection attacks. HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to obtain confidential information.

The vulnerability of the McAfee VirusScan Enterprise antivirus software arises from the failure to handle CRLF sequences in headers properly. Exploiting this vulnerability can allow a remote attacker to obtain confidential information...

IBM WebSphere Application Server 8.0.0.x < 8.0.0.13 Multiple Vulnerabilities

Binary data 700016.prm...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.43 Multiple Vulnerabilities

Binary data 700015.prm...

CVE-2016-8024

Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing...

CVE-2016-8024

Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing...

GNU Wget CRLF Injection Vulnerability (CNVD-2017-03817)

GNU Wget is a set of free software developed by the GNU Project for downloading over the Internet, which supports downloading over the three most common TCP/IP protocols: HTTP, HTTPS, and FTP. A CRLF injection vulnerability exists in the 'urlparse' function of the url.c file in GNU Wget 1.19.1 an...

CVE-2017-6508

A CRLF injection flaw was found in the way wget handled URLs. A remote attacker could use this flaw to inject arbitrary HTTP headers in requests, via CRLF sequences in the host sub-component of a URL, by tricking a user running wget into processing crafted URLs...

Crlf injection

CRLF injection vulnerability in the urlparse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL...

DEBIAN-CVE-2017-6508

CRLF injection vulnerability in the urlparse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL...

CVE-2017-6508

CRLF injection vulnerability in the urlparse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL...

CVE-2017-6508

CRLF injection vulnerability in the urlparse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL...