4704 matches found
CVE-2016-8024
Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing...
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...
CVE-2017-5638: Improper Handling of Exceptional Conditions
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...
CVE-2017-1124
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...
Design/Logic Flaw
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...
CVE-2017-1124
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...
CVE-2017-1124
CVE-2017-1124 affects IBM Maximo Asset Management core versions 7.6, 7.5 and 7.1 (and Maximo Asset Management Essentials) plus affected IBM Industry Solutions and Control Desk products when installed on a vulnerable core. Root cause: HTTP header injection enabling local information disclosure by ...
CVE-2017-1124
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...
CVE-2017-1124: Exposure of Sensitive Information to an Unauthorized Actor
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...
Evostream Media Server 1.7.1 (x64) - Denial of Service
Evostream Media Server 1.7.1 x64 - Denial of Service Exploit Title: Evostream Media Server 1.7.1 – Built-in Webserver DoS Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://evostream.com/software-downloads/ Version: 1.7.1 Tested on:...
PT-2017-11845
Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.1, 7.5, and 7.6 Description The issue allows a local attacker to obtain sensitive information using HTTP Header Injection. Recommendations For versions 7.1, 7.5, and 7.6, update to a version that includes...
CVE-2017-5615
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location...
CVE-2017-5615
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location...
CVE-2017-5615: URL Redirection to Untrusted Site
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location...
PT-2017-16619
Name of the Vulnerable Software and Affected Versions cgiemail and cgiecho affected versions not specified Description The issue allows remote attackers to inject HTTP headers via a newline character in the redirect location. Recommendations At the moment, there is no information about a newer...
JVN#46830433: Multiple I-O DATA network camera products multiple vulnerabilities
Multiple network camera products provided by I-O DATA DEVICE, INC. contain multiple vulnerabilities listed below. HTTP header injection CWE-113 - CVE-2017-2111 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N| Base Score: 4.7 CVSS v2|...
Insecure Password Reset
securesocial is vulnerable to insecure password resets. These attacks are possible because an attacker can trigger securesocial to send a password-reset email to a user with with a malicious link included. By setting the "Host" HTTP header to a domain and sending a POST request to securesocial...
Ubiquiti Inc.: AirFibre products vulnerable to HTTP Header injection
The uri GET parameter of Login.cgi is directly used on login to generate HTTP headers without sanitisation. An user could be tricked into logging into the device and then redirected to a malicious location or attacked through other HTTP Header injection attacks. Vulnerable code: if isset$uri &&...