CVE-2020-5247

In Puma RubyGem before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters i.e. CR, LF or/r, /n to end the header and inject malicious content, such as additional headers or an entirely new response body. This...

GHSA-84J7-475P-HP8V HTTP Response Splitting in Puma

In Puma RubyGem before 4.3.2 and 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters i.e. CR, LF or/r, /n to end the header and inject malicious content, such as additional headers or an entirely new response body. This...

D-Link DGS-1250 Header Injection Vulnerability

D-Link Dgs-1250 series is a new generation of intelligent 10g port Gigabit network switch. A command injection vulnerability exists in the D-Link DGS-1250 product. An attacker can exploit this vulnerability to execute arbitrary commands...

D-Link DGS-1250 Header Injection Vulnerability

Exploit for hardware platform in category web applications D-Link DGS-1250 header injection vulnerability ============================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/d-link-dgs-1250-header-injection.txt Overview -------- D-Lin...

D-Link DGS-1250 Header Injection

D-Link DGS-1250 header injection vulnerability ============================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/d-link-dgs-1250-header-injection.txt Overview -------- D-Link DGS-1250 switch is susceptible to a header injection...

CVE-2020-6181

Under some circumstances the SAML SSO implementation in the SAP NetWeaver SAPBASIS versions 702, 730, 731, 740 and SAP ABAP Platform SAPBASIS versions 750, 751, 752, 753, 754, allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response...

CVE-2020-5216

A directive injection vulnerability was found in Secure Headers RubyGem before versions 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into the vulnerable function, a new line could be injected, leading to limited header injection, which could create a new Content Security Policy head...

The vulnerability of the API Framework web server component of Cisco Web Security Appliance (WSA) and the Cisco Content Security Management Appliance (SMA) security management device allows a perpetrator to inject arbitrary HTTP headers into responses.

The vulnerability of the API Framework web server component of Cisco Web Security Appliance WSA and the Cisco Content Security Management Appliance SMA security management device is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a malicious...

Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

According to its self-reported version, the Cisco Content Security Management Appliance SMA is affected by a HTTP Header Injection vulnerability. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. C Tenable Network Security, Inc. include'compat.inc'; if...

Design/Logic Flaw

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...

UBUNTU-CVE-2020-5216

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...

CVE-2020-5216

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...

CVE-2020-5216

The CVE-2020-5216 issue affects the RubyGem Secure Headers library. Affected versions before 3.9.0, 5.2.0, and 6.3.0 contain a directive injection flaw: if user-supplied input is passed into append/override_content_security_policy_directives, a newline can be injected, causing Rails to silently c...

CVE-2020-5216 Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...

GHSA-W978-RMPF-QMWG Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the...

Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

The Cisco Content Security Management Appliance SMA and the Cisco Web Security Appliance WSA are both products of Cisco, Inc.The Cisco Web Security Appliance is a Web security appliance. The appliance provides SaaS-based access control, real-time network reporting and tracking, and the developmen...

secure_headers header injection due to newline

If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original...

CVE-2019-6146

It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...

CVE-2019-6146

It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...

Cross site scripting

It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...