Shopify: HTTP-Response-Splitting on v.shopify.com

I discovered a HTTP-Response-Splitting issue on v.shopify.com Steps to reproduce: Call the following URL in any browser and catch the response e.g. with burp...

Link Log < 2.0 - HTTP Response Splitting

The Link Log – external link click monitor WordPress plugin was affected by a HTTP Response Splitting security vulnerability...

CVE-2015-5245

CRLF injection vulnerability in the Ceph Object Gateway aka radosgw or RGW in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name...

CVE-2015-5245

CRLF injection vulnerability in the Ceph Object Gateway aka radosgw or RGW in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name...

CVE-2015-5245

CRLF injection vulnerability in the Ceph Object Gateway aka radosgw or RGW in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name...

CVE-2015-5245

Ceph Object Gateway (RGW) is affected by a CRLF injection vulnerability caused by improper validation of user-supplied input. This allows a remote attacker to inject arbitrary HTTP headers and conduct HTTP response splitting via a crafted bucket name, affecting Ceph versions before 0.94.4. Remedi...

CVE-2015-5245

CRLF injection vulnerability in the Ceph Object Gateway aka radosgw or RGW in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name...

CVE-2015-2017

CRLF injection vulnerability in IBM WebSphere Application Server WAS 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

Crlf injection

CRLF injection vulnerability in IBM WebSphere Application Server WAS 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2015-2017

CVE-2015-2017 is an HTTP response-splitting/CRLF injection vulnerability in IBM WebSphere Application Server. Affected are WAS 6.1 (up to 6.1.0.47), 7.0 (before 7.0.0.39), 8.0 (before 8.0.0.12), and 8.5 (before 8.5.5.8). Exploitation could allow remote attackers to inject headers and perform resp...

Kallithea 'came_from' parameter HTTP Response Splitting Vulnerability

Kallithea is prone to http response splitting vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:kallithea:kallithea"...

actiTIME 2015.2 - Multiple Vulnerabilities

actiTIME 2015.2 - Multiple Vulnerabilities actiTIME 2015.2 Multiple Vulnerabilities Vendor: Actimind, Inc. Product web page: http://www.actitime.com Affected version: 2015.2 Small Team Edition Summary: actiTIME is a web timesheet software. It allows you to enter time spent on different work...

actiTIME 2015.2 Multiple Vulnerabilities

Exploit for php platform in category web applications actiTIME 2015.2 Multiple Vulnerabilities Vendor: Actimind, Inc. Product web page: http://www.actitime.com Affected version: 2015.2 Small Team Edition Summary: actiTIME is a web timesheet software. It allows you to enter time spent on different...

actiTIME 2015.2 Privilege Escalation / Open Redirect

actiTIME 2015.2 Multiple Vulnerabilities Vendor: Actimind, Inc. Product web page: http://www.actitime.com Affected version: 2015.2 Small Team Edition Summary: actiTIME is a web timesheet software. It allows you to enter time spent on different work assignments, register time offs and sick leaves,...

GLSA-201510-06 : Django: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201510-06 Django: Multiple vulnerabilities Multiple vulnerabilities have been found in Django: Session backends create a new record anytime request.session was accessed CVE-2015-5143 Built-in validators in Django do not properly...

actiTIME 2015.2 - Multiple Vulnerabilities

actiTIME 2015.2 Multiple Vulnerabilities Vendor: Actimind, Inc. Product web page: http://www.actitime.com Affected version: 2015.2 Small Team Edition Summary: actiTIME is a web timesheet software. It allows you to enter time spent on different work assignments, register time offs and sick leaves,...

Django: Multiple vulnerabilities

Background Django is a Python-based web framework. Description Multiple vulnerabilities have been found in Django: Session backends create a new record anytime request.session was accessed CVE-2015-5143 Built-in validators in Django do not properly sanitize input CVE-2015-5144 URL validation...

actiTIME 2015.2 Multiple Vulnerabilities

Summary actiTIME is a web timesheet software. It allows you to enter time spent on different work assignments, register time offs and sick leaves, and then create detailed reports covering almost any management or accounting needs. Description The application suffers from multiple security...

CVE-2015-5285

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

Crlf injection

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...