CVE-2011-4586

CRLF injection vulnerability (HTTP header injection/response splitting) in Moodle Calendar subsystem via calendar/set.php affects Moodle 1.9.x <1.9.15, 2.0.x <2.0.6, and 2.1.x

PT-2012-1918 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.14 Moodle versions 2.0.x through 2.0.5 Moodle versions 2.1.x through 2.1.2 Description: A CRLF injection issue exists in the Calendar subsystem, specifically in calendar/set.php, allowing remote attackers to...

CVE-2012-0796

class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted 1 From: or 2 Sender: header...

CVE-2012-0796: Improper Control of Generation of Code

class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted 1 From: or 2 Sender: header...

Fedora 15 : python-tornado-2.2.1-1.fc15 (2012-8205)

Update to 2.2.1 which fixes an HTTP header injection vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 16 : python-tornado-2.2.1-1.fc16 (2012-8217)

Update to 2.2.1 which fixes an HTTP header injection vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 17 : python-tornado-2.2.1-1.fc17 (2012-8194)

Update to 2.2.1 which fixes an HTTP header injection vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

DEBIAN-CVE-2012-2374

CRLF injection vulnerability in the tornado.web.RequestHandler.setheader function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input...

PYSEC-2012-5

CRLF injection vulnerability in the tornado.web.RequestHandler.setheader function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input...

PT-2012-3992

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 2.2.1 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input. This is due to a CRLF injection vulnerability in the...

PT-2012-1682 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA 5500 series devices versions 8.0 through 8.4 Description: A CRLF injection issue exists in the /+CSCOE+/logon.html endpoint, allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP...

XSS with multiple Content Security Policy headers — Mozilla

Security Researcher Mike Brooks of Sitewatch reported that if multiple Content Security Policy CSP headers are present on a page, they have an additive effect page policy. Using carriage return line feed CRLF injection, a new CSP rule can be introduced which allows for cross-site scripting XSS on...

PT-2012-2486

Name of the Vulnerable Software and Affected Versions Cogent DataHub versions 7.1.2 and earlier Cascade DataHub versions 6.4.20 and earlier OPC DataHub versions 6.4.20 and earlier Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting...

Cogent DataHub vulnerable to HTTP header injection

Overview Cogent DataHub provided by Cogent Real-Time Systems Inc. contains a HTTP header injection vulnerability also known as CRLF, carriage return line feed, injection vulnerability. Kuang-Chun Hung of Security Research and Service Institute - Information and Communication Security Technology...

UBUNTU-CVE-2011-4203

CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable...

perl-CGI-Simple: - hardcoded MIME boundary value for multipart content, CVE-2010-4410 - CRLF injection allowing HTTP response splitting

The multipartinit function in 1 CGI.pm before 3.50 and 2 Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks v...

perl-CGI-Simple: - hardcoded MIME boundary value for multipart content, CVE-2010-4410 - CRLF injection allowing HTTP response splitting

CRLF injection vulnerability in the header function in 1 CGI.pm before 3.50 and 2 Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline...

PHP 5.x < 5.1.0 Multiple Vulnerabilities

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.1.0. Such versions may be affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists in phpinfo. - Multiple safemode/openbasedir bypass vulnerabilities exist in ext/curl and...

PHP 5.3.115.4.0RC2 - header() HTTP Header Injection

PHP 5.3.115.4.0RC2 - header HTTP Header Injection source: https://www.securityfocus.com/bid/55297/info PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL. By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery,...

PHP 5.3.11/5.4.0RC2 - 'header()' HTTP Header Injection

source: https://www.securityfocus.com/bid/55297/info PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL. By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks...