Crlf injection

CRLF injection vulnerability in the onreq function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI...

CVE-2016-1133

CVE-2016-1133 affects the H2O HTTP Server. The vulnerability is a CRLF injection in the on_req function (lib/handler/redirect.c) that enables remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via a crafted URI. Affected versions are H2O before 1.6.2 and 1.7.x b...

JVN#45928828: H2O vulnerable to HTTP header injection

H2O is an open source web server software. H2O contains an HTTP header injection vulnerability. Impact An HTTP response splitting attack may result in arbitrary cookie values. Solution Update the Software Update to the latest version according to the information provided by the developer. Product...

h2o -- directory traversal vulnerability

Yakuzo OKU reports: When redirect directive is used, this flaw allows a remote attacker to inject response headers into an HTTP redirect response...

H2O Directory Traversal Vulnerability

H2O is a set of open source Web server software . H2O suffers from a directory traversal vulnerability. When the program uses the file.dir directive, a remote attacker can exploit the vulnerability to read arbitrary files with the help of a specially crafted URL...

Directory traversal

Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL...

CVE-2015-5638

Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL...

CVE-2015-5638

Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL...

CVE-2015-5638

Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL...

CVE-2015-5638

H2O Web Server vulnerability CVE-2015-5638: Directory traversal via the file.dir directive enables remote reading of arbitrary server files. A URL processing/normalization flaw in H2O up to versions 1.4.4 and 1.5.0-beta1 allows exploitation when file.dir is enabled. Affected versions: H2O before ...

H2O vulnerable to directory traversal

Overview H2O is an open source web server software. H2O contains an issue in processing URL, which may result in a directory traversal CWE-22 vulnerability. Yusuke OSUMI reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

FreeBSD : h2o -- directory traversal vulnerability (31ea7f73-5c55-11e5-8607-74d02b9a84d5)

Yakuzo reports : H2O up to version 1.4.4 / 1.5.0-beta1 contains a flaw in its URL normalization logic. When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive. H2O version 1.4.5 and version...

JVN#65602714: H2O vulnerable to directory traversal

H2O is an open source web server software. H2O contains an issue in processing URL, which may result in a directory traversal CWE-22 vulnerability. Impact A remote attacker may obtain arbitrary files on the server if "file.dir" directive is specified. Solution Update the Software Update to the...

h2o -- directory traversal vulnerability

Yakuzo reports: H2O up to version 1.4.4 / 1.5.0-beta1 contains a flaw in its URL normalization logic. When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive. H2O version 1.4.5 and version...

CVE-2014-6905

The H2O Human Harmony Organization aka com.netpia.ha.theh2o application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The H2O Human Harmony Organization aka com.netpia.ha.theh2o application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6905

The CVE-2014-6905 entry concerns the H2O Human Harmony Organization Android app (package com.netpia.ha.theh2o), version 1.6.5, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a cra...

CVE-2014-6905

The H2O Human Harmony Organization aka com.netpia.ha.theh2o application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

H2O-CMS <= 3.4 - Remote Command Execution Exploit (mq = off)

No description provided by source. !/usr/bin/perl ---------------------------------------------------------- H2O-CMS = 3.4 Remote Command Execution Exploit mq = Off Discovered By StAkeRathotmaildotit Download On http://sourceforge.net/projects/h2o-cms...

H2O-CMS <= 3.4 Insecure Cookie Handling Vulnerability

No description provided by source. ---------------------------------------------------------- H2O-CMS = 3.4 Insecure Cookie Handling Vulnerability Discovered By Mountassif Moad Download On http://sourceforge.net/projects/h2o-cms Home World http://v4-team.com...