4599 matches found
[DRUPAL-SA-2006-004] Drupal 4.6.6 / 4.5.8 fixes mail header injection issue
---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2006-004 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2006-004 Project: Drupal core Date: 2006-03-13 Security risk: moderately...
DRUPAL-SA-2006-004 Mail header injection vulnerability
Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Versions affected All Drupal versions before 4.6.6. Solution If you are runnin...
drupal -- multiple vulnerabilities
Drupal reports: Mail header injection vulnerability. Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Session fixation...
CVE-2006-0712
The CVE-2006-0712 issue affects Squishdot before 1.5.0 and its mail_html template, where improper validation of the (1) email and (2) title variables enables remote attackers to inject SMTP headers (likely via CRLF) and bypass spam filters. The root cause is input validation gaps in the mail_html...
[VulnWatch] XSS & Header Injection in Drupal and vBulletin
A fake image header with actual html body content was able to get past phpbb's input validation. An exploit was issued for phpbb a month ago and that sparked me to check some other webapps. vbulletin 3.5.0 forum file attachments did not sanitize against this, as a result Jelsoft quickly issued...
[SA17763] PHP "mb_send_mail()" "To:" Header Injection Vulnerability
TITLE: PHP "mbsendmail" "To:" Header Injection Vulnerability SECUNIA ADVISORY ID: SA17763 VERIFY ADVISORY: http://secunia.com/advisories/17763/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: PHP 4.4.x http://secunia.com/product/5768/ PHP...
[SA16270] UNG "name" and "email" Mail Header Injection
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
LogMeIn 'cfgadvanced.html' HTTP Header Injection
Binary data 5045.prm...
BasiliX Webmail 1.1 - Email Header HTML Injection
source: https://www.securityfocus.com/bid/10662/info BasiliX Webmail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to gain acces...
SqWebMail 4.0.4.20040524 - Email Header HTML Injection
source: https://www.securityfocus.com/bid/10588/info SqWebMail is reported to be prone to an email header HTML injection vulnerability. This issue presents itself due to a failure of the application to properly sanitize user-supplied email header strings. The problem presents itself when an...
SquirrelMail 1.2.x - From Email Header HTML Injection
source: https://www.securityfocus.com/bid/10450/info SquirrelMail is reported to be prone to a 'from' field email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to...
[Full-Disclosure] Aprelium Abyss webserver X1 arbitrary code execution and header injection
-- Description -- Abyss Web Server is a free, closed-source, personal web server for Windows and Linux operating systems. Homepage : http://www.aprelium.com The Hackademy Audit team has found two remote security holes in Abyss Webserver X1, allowing arbitrary code execution and header injection. ...
Abyss Web Server GET Request Multiple Vulnerabilities
The remote Abyss Web server is earlier than version 1.1.6. Such versions are reportedly vulnerable to a buffer overflow that could be exploited by an attacker to execute arbitrary code on the host. In addition, it is possible to inject malicious data into server response headers using a specially...
DEBIAN-CVE-2002-1405
CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters...
IBM Websphere Edge Server 3.694.0 - HTTP Header Injection
IBM Websphere Edge Server 3.694.0 - HTTP Header Injection source: https://www.securityfocus.com/bid/6001/info A vulnerability has been discovered in the Caching Proxy component bundled with the IBM Websphere Edge Server. Due to insufficient sanitization of user-supplied input it is possible for a...
IBM Websphere Edge Server 3.69/4.0 - HTTP Header Injection
source: https://www.securityfocus.com/bid/6001/info A vulnerability has been discovered in the Caching Proxy component bundled with the IBM Websphere Edge Server. Due to insufficient sanitization of user-supplied input it is possible for an attacker to construct a malicious link which contains...
CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
More info at https://symfony.com/cve-2026-45070...