CVE-2016-0400

Summary of this CVE (CVE-2016-0400) : IBM WebSphere eXtreme Scale (client) is vulnerable to an HTTP response splitting/CRLF injection due to improper validation of user-supplied input when processing crafted requests. The issue can allow an attacker to inject arbitrary HTTP headers via a crafted ...

FreeBSD : Python -- HTTP Header Injection in Python urllib (a61374fc-3a4d-11e6-a671-60a44ce6887b)

Guido Vranken reports : HTTP header injection in urrlib2/urllib/httplib/http.client with newlines in header values, where newlines have a semantic consequence of denoting the start of an additional header line. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Ruby HTTP Header Injection

TIMELINE rootredrain submitted a report to Ruby. show raw Jun 22nd Hi, I would like to report a HTTP Header injection vulnerability in 'net/http' that allows attackers to inject arbitrary headers in request even create a new evil request. PoC require 'net/http' http =...

MGASA-2016-0230 Updated python packages fix security vulnerabilities

Updated python and python3 packages fixes security vulnerability: - Heap overflow in zipimporter module CVE-2016-5636. - HTTP header injection in urrlib2/urllib/httplib/http.client CVE-2016-5699. - smtplib StartTLS stripping attack CVE-2016-0772...

Ruby: Ruby:HTTP Header injection in 'net/http'

Hi, I would like to report a HTTP Header injection vulnerability in 'net/http' that allows attackers to inject arbitrary headers in request even create a new evil request. PoC require 'net/http' http = Net::HTTP.new'192.168.30.214','80' res = http.get"/r.php HTTP/1.1\r\nx-injection: memeda" F1009...

CVE-2016-1224: Improper Neutralization of Input During Web Page Generation

CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting XSS attacks via unspecified vectors...

Python Injection of Arbitrary HTTP Headers Vulnerability

Python is an open source, object-oriented programming language. Python's urrlib2/urllib/httplib/http.client file 'HTTP Connection.putheader' function uses insecure characters that allow remote attackers to exploit vulnerabilities to inject arbitrary HTTP headers for spoofing attacks...

Nextcloud: Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11

Hi, I noticed that the redirecturi used to redirect users to any location on the page, passes in all data into a header"Location.. without any validation. The problem is that PHP current PHP-versions of Debian/Ubuntu, there seem to be a patch properly in place in other dists actually built the...

Trend Micro Worry-Free Business Security and Worry-Free Business Security Services HTTP Header Injection Vulnerability

Trend Micro Worry-Free Business Security and Worry-Free Business Security Services are both antivirus programs from Trend Micro. An HTTP header injection vulnerability exists in Trend Micro Worry-Free Business Security version 9.0 and Worry-Free Business Security Services version 5.x, which can b...

WS-2016-7070

HTTP header injection vulnerability in civetweb before v1.9...

Uber: Header Injection

Hi Uber , I would like to report an issue on the domain http://m.uber.com Upon testing some back and forth requests to this domain , I figured out that it is possible to inject arbitrary content into the Headers of the requests . Upon increasing the size of the payload in the header , it leads to...

Trend Micro enterprise products HTTP header injection vulnerability

Overview Multiple enterprise products provided by Trend Micro Incorporated contain a HTTP header injection vulnerability. According to the developer, exploiting the vulnerability requires access to the LAN environment of the user. Trend Micro Incorporated reported this vulnerability to JPCERT/CC ...

JVN#48847535: Trend Micro enterprise products multiple vulnerabilities

Multiple enterprise products provided by Trend Micro Incorporated contain the following vulnerabilities. Directory Traversal - CVE-2016-1223 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N| Base Score: 4.3 CVSS v2| AV:A/AC:L/Au:N/C:P/I:N/A:N| Base Score:...

IBM WebSphere eXtreme Scale HTTP Response Splitting Vulnerability

IBM WebSphere eXtreme Scale is a distributed caching solution from IBM USA. The solution provides high-performance, scalable caching framework and grid technology to handle massive transactions, reduce database performance limitations and so on. An HTTP response splitting vulnerability exists in...

DotCMS Email Header Injection Vulnerability

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A security vulnerability exists in DotCMS versions prior to 3.5 and prior to 3.3.2. An attacker can exploit the...

dotCMS Email Header Injection

Title: CVE-2016-4803 dotCMS - Email Header Injection Credit: Elar Lang / https://security.elarlang.eu Vulnerability: Email Header Injection Vulnerable version: before 3.5 / 3.3.2 CVE: CVE-2016-4803 Vendor: dotCMS http://dotcms.com/ Description dotCMS has an email sending functionality at path...

PayPal Bug Bounty Filter Bypass Vulnerability

PayPal is an e-commerce application that provides online payment and money transaction services. A filter bypass vulnerability exists in PayPal. A remote attacker is able to inject malicious script code into some email headers...

Drupal 6.x < 6.38 Multiple Vulnerabilities (SA-CORE-2016-001) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Trend Micro - CoreServiceShell.exe Multiple HTTP s

Trend Micro - CoreServiceShell.exe Multiple HTTP s Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=775 The main component of Trend Micro Antivirus is CoreServiceShell.exe, which runs as NT AUTHORITY\SYSTEM. The CoreServiceShell includes an HTTP daemon, which is used for...

Trend Micro - Multiple HTTP Problems with CoreServiceShell.exe

Exploit for windows platform in category web applications Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=775 The main component of Trend Micro Antivirus is CoreServiceShell.exe, which runs as NT AUTHORITY\SYSTEM. The CoreServiceShell includes an HTTP daemon, which is used for...