python: http protocol steam injection attack

It was found that the Python's httplib library used by urllib, urllib2 and others did not properly check HTTPConnection.putheader function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values...

Cybozu Mailwise Email Header Injection Vulnerability

Cybozu Mailwise is a Web-based e-mail system from Cybozu. An email header injection vulnerability exists in Cybozu Mailwise versions 5.0.0 through 5.3.2. An attacker can exploit this vulnerability to modify the content and perform unauthorized operations...

Cybozu Mailwise vulnerable to mail header injection

Overview Cybozu Mailwise contains a mail header injection vulnerability in the process of sending emails. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning...

IBM Connections Host Header Injection Vulnerability

IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A host header injectio...

JVN#01353821: Cybozu Mailwise vulnerable to mail header injection

Cybozu Mailwise contains a mail header injection vulnerability in the process of sending emails. Impact If a user is tricked into sending a specially crafted request, the header of the email to be sent may be altered. Solution Update the Software Update to the latest version according to the...

ESXi 5.0 / 5.1 / 5.5 / 6.0 Multiple Vulnerabilities (VMSA-2016-0010) (remote check)

The remote VMware ESXi host is version 5.0, 5.1, 5.5, or 6.0 and is missing a security patch. It is, therefore, affected by multiple vulnerabilities : - An arbitrary code execution vulnerability exists in the Shared Folders HGFS feature due to improper loading of Dynamic-link library DLL files fr...

VMware vCenter Server 6.0.x < 6.0u2 Unspecified HTTP Header Injection (VMSA-2016-0010)

The version of VMware vCenter Server installed on the remote host is 6.0.x prior to 6.0u2. It is, therefore, affected by an HTTP header injection vulnerability due to improper sanitization of user-supplied input. A remote attacker can exploit this to inject arbitrary HTTP headers and conduct HTTP...

Instacart: Host Header Injection/Redirection in: https://www.instacart.com/

Hi, Your website is vulnerable to Host Header Injection because the host header can be changed to something outside the target domain In many cases, developers are trusting the HTTP Host header value and using it to generate links, import scripts and even generate password resets links with its...

VMware vCenter Server/ESXi CRLF Injection Vulnerability

VMware vCenter Server enables rapid deployment of virtual machines and monitors the performance of physical servers and virtual machines. A CRLF injection vulnerability exists in VMware vCenter Server U2 prior to version 6.0 and ESXi 6.0, which can be exploited by remote attackers to inject...

CVE-2016-5331

CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

VMware Security Updates for vCenter Server (VMSA-2016-0010) - Active Check

vCenter contain an HTTP header injection vulnerability due to lack of input validation. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

VMware ESXi Multiple Vulnerabilities (VMSA-2016-0010) - Active Check

ESXi contains an HTTP header injection vulnerability due to lack of input validation. An attacker can exploit this issue to set arbitrary HTTP response headers and cookies, which may allow for cross-site scripting and malicious redirect attacks. SPDX-FileCopyrightText: 2016 Greenbone AG Some text...

VMware Security Updates for vCenter Server (VMSA-2016-0010)

vCenter Server contain an HTTP header injection vulnerability due to lack of input validation. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

VMware ESXi product updates address multiple important security issues (VMSA-2016-0010) - Local Version Check

ESXi contain an HTTP header injection vulnerability due to lack of input validation. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

VMware ESXi product updates address multiple important security issues (VMSA-2016-0010) - Remote Version Check

ESXi contain an HTTP header injection vulnerability due to lack of input validation. An attacker can exploit this issue to set arbitrary HTTP response headers and cookies, which may allow for cross-site scripting and malicious redirect attacks. SPDX-FileCopyrightText: 2016 Greenbone AG Some text...

openSUSE Security Update : python (openSUSE-2016-906)

Python was updated to fix three security issues. The following vulnerabilities were fixed : - CVE-2016-0772: TLS stripping attack on smtplib bsc984751 - CVE-2016-5636: zipimporter heap overflow bsc985177 - CVE-2016-5699: httplib header injection bsc985348 This update also includes all upstream bu...

The vulnerability of WebSphere Application Server’s application servers allows attackers to inject arbitrary HTTP headers.

The vulnerability of WebSphere Application Server for application servers exists due to the lack of measures to address the CRLF sequence return with a line break. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers using a specially crafted URL...

The vulnerability of the microprogramming software of Siemens Simatic S7-1200 programmable logic controllers allows a malicious individual to inject HTML headers.

The software of the programmable logic controller Simatic S7-1200 contains a vulnerability that allows a malicious individual to inject an HTML header into the device’s web server...

The vulnerability of the Oracle Fusion Middleware software platform allows a malicious actor to inject arbitrary data into the context of a vulnerable application.

The vulnerability of the Oracle Containers component for the J2EE software platform, Oracle Fusion Middleware, is related to an error that occurs due to insufficient checking of values in HTTP headers. Exploiting this vulnerability allows a malicious actor to generate a forged HTTP response and...

CVE-2016-0359

CRLF injection vulnerability in IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a...