CVE-2017-1124: Exposure of Sensitive Information to an Unauthorized Actor

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...

PT-2017-11845

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 Description The issue allows a local attacker to obtain sensitive information using HTTP Header Injection. Recommendations For versions 7.1, 7.5, and 7.6, update to a version that includes...

Evostream Media Server 1.7.1 (x64) - Denial of Service

Evostream Media Server 1.7.1 x64 - Denial of Service Exploit Title: Evostream Media Server 1.7.1 – Built-in Webserver DoS Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://evostream.com/software-downloads/ Version: 1.7.1 Tested on:...

CVE-2017-5615

cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location...

CVE-2017-5615

cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location...

CVE-2017-5615: URL Redirection to Untrusted Site

cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location...

PT-2017-16619

Name of the Vulnerable Software and Affected Versions cgiemail and cgiecho affected versions not specified Description The issue allows remote attackers to inject HTTP headers via a newline character in the redirect location. Recommendations At the moment, there is no information about a newer...

JVN#46830433: Multiple I-O DATA network camera products multiple vulnerabilities

Multiple network camera products provided by I-O DATA DEVICE, INC. contain multiple vulnerabilities listed below. HTTP header injection CWE-113 - CVE-2017-2111 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N| Base Score: 4.7 CVSS v2|...

Insecure Password Reset

securesocial is vulnerable to insecure password resets. These attacks are possible because an attacker can trigger securesocial to send a password-reset email to a user with with a malicious link included. By setting the "Host" HTTP header to a domain and sending a POST request to securesocial...

Ubiquiti Inc.: AirFibre products vulnerable to HTTP Header injection

The uri GET parameter of Login.cgi is directly used on login to generate HTTP headers without sanitisation. An user could be tricked into logging into the device and then redirected to a malicious location or attacked through other HTTP Header injection attacks. Vulnerable code: if isset$uri &&...

CVE-2016-6603

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header...

CVE-2016-4793

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...

CVE-2016-4793

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...

CVE-2016-6603

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header...

CVE-2016-6484

CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf...

CVE-2016-6603

CVE-2016-6603 affects ZOHO WebNMS Framework 5.2 and 5.2 SP1. The vulnerability allows remote attackers to bypass authentication and impersonate arbitrary users by sending a manipulated UserName HTTP header, enabling session hijacking via the GetChallengeServlet in WebNMS. Multiple connected sourc...

CVE-2016-4793

Removed by vendor...

aerial (0.1.0), afterparty (0.1.0) +345 more potentially affected by CVE-2017-18587 via hyper (>=0.0.1, <=0.9.14)

hyper CARGO version =0.0.1, =0.7.0, =0.1.0, =0.1.3, =0.5.1, =0.1.2, =0.5.3, =0.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2017-18587 Source advisory: OSV:RUSTSEC-2017-0002...

PT-2017-9001

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 Description The issue allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. Recommendations For ZOHO WebNMS Framework versions 5.2 and 5.2...

[SECURITY] [DLA 761-1] python-bottle security update

Package : python-bottle Version : 0.10.11-1+deb7u2 CVE ID : CVE-2016-9964 Debian Bug : 848392 It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks...