H2O vulnerable to HTTP header injection

Overview H2O is an open source web server software. H2O contains an HTTP header injection vulnerability. Kazuho Oku reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Kazuho Oku coordinated under the Information Security Early Warning Partnership. Impact...

JVN#45928828: H2O vulnerable to HTTP header injection

H2O is an open source web server software. H2O contains an HTTP header injection vulnerability. Impact An HTTP response splitting attack may result in arbitrary cookie values. Solution Update the Software Update to the latest version according to the information provided by the developer. Product...

cgit -- multiple vulnerabilities

Jason A. Donenfeld reports: Reflected Cross Site Scripting and Header Injection in Mimetype Query String. Stored Cross Site Scripting and Header Injection in Filename Parameter. Integer Overflow resulting in Buffer Overflow...

SUSE-SU-2016:0044-1 Security update for python-Django

This update fixes the following security issues: - bnc955412, CVE-2015-8213 Possible settings leak in date template filter - bnc937522, CVE-2015-5143 Possible denial-of-service in session store - bnc937523, CVE-2015-5144 Possible Header injection - bnc941587, CVE-2015-5963 Possible...

PHP code auditing tool Rips Scanners v0. 5 aeration local file inclusion vulnerability-vulnerability warning-the black bar safety net

! RIPS is a php source code analysis tool, which uses static analysis technology to automate the mining of the PHP source code for potential security vulnerabilities. Penetration testers can directly easily review the results of the analysis, without review of the entire program code. Since stati...

Rips Scanners（0.5）aeration a local file inclusion vulnerability-vulnerability warning-the black bar safety net

RIPS is a php source code analysis tool, which uses static analysis technology to automate the mining of the PHP source code for potential security vulnerabilities. Penetration testers can directly easily review the results of the analysis, without review of the entire program code. Since static...

Debian DLA-363-1 : libphp-phpmailer security update

It was discovered that there was a header injection vulnerability in libphp-phpmailer, am email transfer library for PHP. For Debian 6 Squeeze, this issue has been fixed in libphp-phpmailer version 5.1-1+deb6u11. NOTE: Tenable Network Security has extracted the preceding description block directl...

[SECURITY] [DLA 363-1] libphp-phpmailer security update

Package : libphp-phpmailer Version : 5.1-1+deb6u11 CVE ID : CVE-2015-8476 Debian Bug : 807265 It was discovered that there was a header injection vulnerability in libphp-phpmailer, am email transfer library for PHP. For Debian 6 Squeeze, this issue has been fixed in libphp-phpmailer version...

DLA-363-1 libphp-phpmailer - security update

Bulletin has no description...

Ceph Object Gateway CRLF Vulnerability

Ceph Object Gateway is an object storage interface built on top of librados that enables applications to access Ceph Storage Clusters, a distributed storage system, through a RESTful gateway. A CRLF injection vulnerability exists in Ceph Object Gateway versions prior to 0.94.4, where a remote...

CVE-2015-5245

CRLF injection vulnerability in the Ceph Object Gateway aka radosgw or RGW in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name...

The vulnerability of WebSphere Application Server’s application servers allows attackers to inject arbitrary HTTP headers.

The vulnerability of WebSphere Application Server applications stems from a lack of handling of CRLF sequences in HTTP headers. Exploiting this vulnerability allows an attacker to inject arbitrary HTTP headers using a specially crafted URL...

curl: URL request injection vulnerability in parseurlandfillconn()

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct...

GetHead - HTTP Header Analysis Vulnerability Tool

gethead.py is a Python HTTP Header Analysis Vulnerability Tool. It identifies security vulnerabilities and the lack of protection in HTTP Headers. Usage: $ python gethead.py http://domain.com Changelog Version 0.1 - Initial Release Written in Python 2.7.5 Performs HTTP Header Analysis Reports...

IBM WebSphere Application Server CRLF Injection Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. IBM WAS suffers from a CRLF injection vulnerability. A remot...

Google Golang Go HTTP Header Injection Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. An HTTP header injection vulnerability exists in Google Golang Go. An attacker can exploit this vulnerability to inject arbitrary HTTP headers into the server response, bypass...

HackerOne: HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com

The subdomain info.hackerone.com is vulnerable to HTTP header injection. I'm aware that you are only interested in critical issues affecting this subdomain. However, you may be interested in this issue as a vulnerability in this domain may affect the domain hackerone.com. The vulnerability is a...

Kallithea CRLF Injection Vulnerability

Kallithea is is a free source code management system. The Kallitheaadmin/login URI fails to adequately filter the 'namefrom' parameter, allowing remote attackers to exploit this vulnerability to inject arbitrary HTTP headers and perform HTTP response splitting attacks...

Apache cordova-plugin-file-transfer HTTP header injection vulnerability

Apache Cordova is the Apache Software Foundation's platform for developing mobile applications using HTML, CSS, and JavaScript, and is the core engine that drives PhoneGap the development framework. Apache cordova-plugin-file-transfer is a file transfer plugin. a file-transfer plugin. An HTTP...

PT-2016-12: HTTP Header Injection in VMware vCenter Server and ESXi

The specialists of the Positive Research center have detected an HTTP Header Injection vulnerability in VMware vCenter Server and ESXi. The application does not properly sanitize user input before using it in HTTP response headers that allows a malicious user to inject arbitrary headers into HTTP...