CVE-2017-14037

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...

Design/Logic Flaw

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...

CVE-2017-14037

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...

CVE-2017-14037

CVE-2017-14037 affects CrushFTP before 7.8.0 and 8.x before 8.2.0, described as an HTTP header vulnerability. Public documents confirm the affected versions and nature of the issue across NVD/Red Hat/CNVD entries; exploitation details are not provided in the supplied materials. CVSS data present ...

CVE-2017-14037: Improper Neutralization of CRLF Sequences

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...

PT-2017-13217

Name of the Vulnerable Software and Affected Versions CrushFTP versions prior to 7.8.0 CrushFTP versions 8.x prior to 8.2.0 Description The issue is related to an HTTP header vulnerability. Recommendations For CrushFTP versions prior to 7.8.0, update to version 7.8.0 or later. For CrushFTP versio...

WordPress: Clickjacking mercantile.wordpress.org

A Clickjaking Issue had been previously reported by "giantfire" on Aug 9th 19 days ago and the issue was fixed by "iandunn" on Aug 25th 3 days ago and the same disclosed on Aug 28th. Here the affected URL is- https://mercantile.wordpress.org/ "iandunn closed the report and changed the status to...

Heap overflow

HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...

CVE-2015-1445

HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...

CVE-2015-1445

CVE-2015-1445 affects the fli4l httpd component. The connected documents confirm an HTTP header injection vulnerability in the httpd package for fli4l before 3.10.1 and in version 4.0 before 2015-01-30. The CVSS metrics indicate a NETWORK-exposed issue with HIGH severity (CVSS v3.0: AV:N/AC:L/PR:...

HTTP Header Injection

vertx-core is vulnerable to HTTP header injections. The library does not validate HTTP header values, allowing attackers to inject arbitrary headers in requests. This vulnerability is a different vulnerability from CVE-2018-12537, however the fix for CVE-2018-12537 remediates this vulnerability...

CVE-2015-1445: Improper Neutralization of CRLF Sequences in HTTP Headers

HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...

PT-2017-6491

Name of the Vulnerable Software and Affected Versions fli4l versions prior to 3.10.1 fli4l versions 4.0 before 2015-01-30 Description The issue concerns HTTP header injection in the httpd package. Recommendations For fli4l versions prior to 3.10.1, update to version 3.10.1 or later. For fli4l...

PT-2017-6364

Name of the Vulnerable Software and Affected Versions IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware versions prior to 3.4.1110 Description The issue allows remote attackers to inject arbitrary HTTP headers, which can lead to HTTP response splitting attacks. This...

In a remote sandbox, free to soar: Adobe Flash Windows user credentials disclosure vulnerability-vulnerability warning-the black bar safety net

One, Foreword Recently, I published about the Flash sandbox escape vulnerabilities of an article, The final result has survived ten years of the Flash Player local security sandbox died a natural death. Before this vulnerability to show us the input data to verify the correctness of importance. T...

CVE-2017-12650

CVE-2017-12650 affects the WordPress Loginizer plugin prior to version 1.3.6. The root cause is improper sanitization of the X-Forwarded-For HTTP header, which is forwarded to the lz_selectquery() function and can be exploited to perform a blind SQL injection via the login workflow. Impact stated...

CVE-2017-12650

SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header...

Open Redirect

rails is vulnerable to open redirects. The X-Forwarded-Host HTTP header is always trusted, allowing a malicious user to pass an invalid host header to redirect a user to a malicious URL...

CVE-2017-9764

Cross-site scripting XSS vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action...

Cross site scripting

Cross-site scripting XSS vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action...