CVE-2016-3116

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data...

CVE-2016-3115

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the 1 doauthenticated1 and 2 sessionx11req functions...

Fedora 23 : proftpd-1.3.5b-1.fc23 (2016-977d57cf2d)

Cumulative maintenance release from upstream. Highlights are: SSH RSA hostkeys smaller than 2048 bits now work properly. MLSD response lines are now properly CRLF terminated. Fixed selection of DH groups from TLSDHParamFile CVE-2016-3125. Various other bug fixes are also included. Note that Tenab...

SUSE-SU-2016:0806-1 Security update for ceph

This update provides Ceph 0.8.11, which fixes the following security issue: - CVE-2015-5245: A CRLF injection vulnerability in the Ceph Object Gateway aka radosgw or RGW could allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket...

OpenSSH <=7.2p1 xauth injection

来源链接： https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 VuNote Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview Name: openssh...

OpenSSH 7.2p1 - (Authenticated) xauth Command Injection

''' Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor: OpenBSD References: http://www.openssh.com/1 Version: 7.2...

OpenSSH 7.2p1 xauth Command Injection / Bypass

Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor: OpenBSD References: http://www.openssh.com/1 Version: 7.2p1 2...

PT-2016-1518

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.2p2 Description The issue allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the do authenticated1 and session x11 req functions. This is due ...

LocalTapiola: CRLF injection in https://verkkopalvelu.lahitapiola.fi/

Hi there, There is an HTTP header injection on https://verkkopalvelu.lahitapiola.fi/a6/VerkkokauppaYTWAR/YT/Etusivu.jsf it allow an attacker to set custom cookies and custom content such as XSS attack within the response. PoC: The parameter p is vulnerable...

DropBearSSHD 2015.71 - Command Injection

Exploit for linux platform in category remote exploits VuNote ============ Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3116 Version: 0.2 Date: Mar 3rd, 2016 Tag: dropbearsshd xauth command injection may lead to forced-command bypass Overview -------- Name: dropbear...

IBM WebSphere Application Server CRLF Injection Vulnerability (Feb 2016)

IBM WebSphere Application Server is prone to a CRLF injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Proxmox VE 3/4 - Insecure Hostname Checking Remote Command Execution

===================================================================== Proxmox VE 3/4 Insecure Hostname Checking Remote Root Exploit, XSS, Privileges escalation ===================================================================== Description =========== Proxmox is a popular virtualization solutio...

KLA10866 Multiple vulnerabilities in Python

Multiple serious vulnerabilities have been found in CPython Python before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2. Malicious users can exploit these vulnerabilities to bypass the TLS protections, inject arbitrary HTTP headers or have unspecified impact. Below is a complete list of...

Mail.ru: [touch.lady.mail.ru] CRLF Injection

PoC: https://touch.lady.mail.ru/%0aSet-Cookie:csrftoken=x;domain=.mail.ru; HTTP Response: HTTP/1.1 301 Moved Permanently ... Location: https://lady.mail.ru/ Set-Cookie:csrftoken=x;domain=.mail.ru; Уязвимость может быть использована для обхода CSRF защиты Django сайтов или для эксплуатации XSS чер...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

Crlf injection

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1138

KDDI HOME SPOT CUBE devices prior to version 2 are affected by a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. This can enable HTTP header manipulation (including potential cookie value changes) and is associated with the HTTP ...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

H2O HTTP Server < 1.6.2, 1.7.x < 1.7.0-beta3 CRLF Injection Vulnerability

H2O HTTP Server is prone to a CRLF injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:h2oproject:h2o";...