Crlf injection

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2016-0400

Summary of this CVE (CVE-2016-0400) : IBM WebSphere eXtreme Scale (client) is vulnerable to an HTTP response splitting/CRLF injection due to improper validation of user-supplied input when processing crafted requests. The issue can allow an attacker to inject arbitrary HTTP headers via a crafted ...

CVE-2016-0400

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2016-4803

CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...

CVE-2016-4803

CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...

Crlf injection

CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...

CVE-2016-4803

CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...

CVE-2016-4803

CVE-2016-4803 affects dotCMS prior to 3.3.2, where the sendEmail functionality is vulnerable to CRLF injection in the subject, enabling remote attackers to inject arbitrary email headers. Root cause is unsanitized CRLF sequences in email header fields. Impact described as header injection risk fo...

Crlf injection

The dsasignsetup function in crypto/dsa/dsaossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack...

CVE-2016-1224

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2016-1224

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2016-1224

CVE-2016-1224 involves an HTTP header injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0. Connected sources confirm that this vulnerability allows injection of HTTP headers and may enable cross-site scripting under certain conditio...

CVE-2016-1224

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...

SUSE SLES11 Security Update : openssh (SUSE-SU-2016:1528-1)

openssh was updated to fix three security issues. These security issues were fixed : - CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related t...

Ubiquiti Inc.: [account-global.ubnt.com] CRLF Injection

PoC any browser except FireFox: http://account-global.ubnt.com/%3f%0dSet-Cookie:crlf=injection%3bdomain=.ubnt.com%3b HTTP Response: HTTP/1.1 302 Found Content-Type: text/html; charset=iso-8859-1 Date: Thu, 16 Jun 2016 09:59:15 GMT Location: https://account-global.ubnt.com/index.html? = injection ...

Sucuri: [support.sucuri.net] CRLF Injection

PoC any browser except FireFox: http://support.sucuri.net/%23%0dSet-Cookie:crlf=injection;domain=.sucuri.net; HTTP Response: HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jun 2016 19:56:14 GMT Server: Apache Location: https://support.sucuri.net/ = injeciton \r...

Mail.ru: [sales.mail.ru] CRLF Injection

В разделе media портала sales.mail.ru существует редирект, который удаляет GET-параметры: GET https://sales.mail.ru/media/foo?bar 302 Moved Temporarily Location: http://sales.mail.ru/media/foo Он подвержен CRLF-инъекции, что позволяет атакующему внедрить произвольный заголовок в ответ сервера: GE...

Mail.ru: [torg.mail.ru] CRLF Injection

Редирект http://torg.mail.ru//foo → http://torg.mail.ru/foo подвержен CRLF-инъекции, что позволяет атакующему внедрить произвольный заголовок в ответ сервера. Пример установки значения куки для всего домена mail.ru: GET http://torg.mail.ru//xxx%0ASet-Cookie:test=test;domain=.mail.ru 301 Moved...

Sucuri: CRLF/HTTP header injection www.sucuri.net

I would like to report a security vulnerability on www.sucuri.net. The domain appears to be vulnerable for CRLF or HTTP header injection. This allows attackers to construct a URL that injects HTTP headers in the server's response. One of the things an attacker can do is injecting a "Set-Cookie"...