Yelp: [engineeringblog.yelp.com] CRLF Injection

CRLF Injection via Request-URI PoC: https://engineeringblog.yelp.com/xxcrlftest%0d%0aSet-Cookie:%20test=test;domain=.yelp.com HTTP Response: HTTP/1.1 301 Moved Permanently ... Location: http://engineeringblog.yelp.com/xxcrlftest Set-Cookie: test=test;domain=.yelp.com Result: Creating a cookie-par...

Shopify: [www.*.myshopify.com] CRLF Injection

CRLF Injection via Request-URI PoC: http://www.myshopify.com/xxcrlftest%0aSet-Cookie:test=test3;domain=.myshopify.com; https://www.blackfan.myshopify.com/xxx%0aSet-Cookie:test=test2;domain=.myshopify.com; HTTP Response: HTTP/1.1 302 Moved Temporarily ... Location: http://myshopify.com/xxcrlftest...

Mail.ru: [s.mail.ru] CRLF Injection

Сценарий перенаправления с https://s.mail.ru/ на https://cloud.mail.ru/ уязвим к атаки типа CRLF Injection. PoC Установка cookie crlf=injection на .mail.ru Подвержены все браузеры, кроме FireFox https://s.mail.ru/test%0dSet-Cookie:crlf=injection;domain=.mail.ru; Может быть использовано в комбинац...

Maian Gallery 2.0 SQL Injection / Header Injection

| Title : Maian Gallery v2.0 Mulllti Vulnerability | Author : indoushka | email : [email protected] | Dork : Maian Gallery v2.0. Copyright © 2006-2015 Maian Script World. All Rights Reserved | Tested on: Win 8.1 fr pro / 21:58 15/05/2015 | Bug : Mulllti | Download :...

Fedora 20 : php-ZendFramework-1.12.13-1.fc20 (2015-8714)

Zend Framework 1.12.13 - 567: Cast int and float to string when creating headers Zend Framework 1.12.12 - 493: PHPUnit not being installed - 511: Add PATCH to the list of allowed methods in ZendControllerRequestHttpTestCase - 513: Save time and space when cloning PHPUnit - 515: !IE conditional...

Fedora 22 : php-ZendFramework-1.12.13-1.fc22 (2015-8704)

Zend Framework 1.12.13 - 567: Cast int and float to string when creating headers Zend Framework 1.12.12 - 493: PHPUnit not being installed - 511: Add PATCH to the list of allowed methods in ZendControllerRequestHttpTestCase - 513: Save time and space when cloning PHPUnit - 515: !IE conditional...

Fedora 21 : php-ZendFramework-1.12.13-1.fc21 (2015-8710)

Zend Framework 1.12.13 - 567: Cast int and float to string when creating headers Zend Framework 1.12.12 - 493: PHPUnit not being installed - 511: Add PATCH to the list of allowed methods in ZendControllerRequestHttpTestCase - 513: Save time and space when cloning PHPUnit - 515: !IE conditional...

CVE-2015-0733

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

Crlf injection

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

CVE-2015-0733

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

CVE-2015-0733

Cisco Headend System Release Digital Broadband Delivery System is affected by a CRLF injection vulnerability in the HTTP Header Handler, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response-splitting attacks (potentially enabling XSS). The issue, tracked as CVE-201...

Fedora 22 : php-ZendFramework2-2.3.8-1.fc22 (2015-7708)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

[SECURITY] [DSA 3265-2] zendframework regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3265-2 [email protected] http://www.debian.org/security/ Alessandro Ghedini May 24, 2015 http://www.debian.org/security/faq -...

Debian DSA-3265-1 : zendframework - security update

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework. Except for CVE-2015-3154, all these issues were already fixed in the version initially shipped with Jessie. - CVE-2014-2681 Lukas Reschke reported a lack of protection against XML External Entity injection attacks in som...

[SECURITY] [DSA 3265-1] zendframework security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3265-1 [email protected] http://www.debian.org/security/ David Prévot May 20, 2015 http://www.debian.org/security/faq -...

Fedora 21 : php-ZendFramework2-2.3.8-1.fc21 (2015-7687)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

DSA-3265-1 zendframework - security update

Bulletin has no description...

Fedora 20 : php-ZendFramework2-2.3.8-1.fc20 (2015-7887)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Debian: Security Advisory (DSA-3265-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...