PYSEC-2015-13

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

PYSEC-2015-13

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

CVE-2015-5285

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

CVE-2015-5285

CVE-2015-5285 affects Kallithea, a web-based source code management system. The vulnerability is a CRLF/HTTP header injection in the came_from parameter of the _admin/login page, enabling an attacker to inject arbitrary HTTP headers and perform HTTP response splitting. Documented affected version...

Deriv.com: Http Response Splitting - Validate link

So i found a http response splitting issue in your website. If we visit the following url: https://www.binary.com/user/validatelink?step=account&verifytoken=sometoken We will get a response header that says: Set-Cookie: verifytoken=sometoken; expires=Wed, 28 Oct 2015 23:31:35 GMT;...

openSUSE Security Update : python-Django (openSUSE-2015-677)

python-django was updated to fix two security issues. These security issues were fixed : - CVE-2015-5144: Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 used an incorrect regular expression, which allowed remote attackers to inject arbitrary headers and...

openSUSE Security Update : python-django (openSUSE-2015-674)

python-django was updated to fix two security issues. These security issues were fixed : - CVE-2015-5144: Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 used an incorrect regular expression, which allowed remote attackers to inject arbitrary headers and...

Kallithea 0.2.9 - came_from HTTP Response Splitting

Kallithea 0.2.9 - camefrom HTTP Response Splitting Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd,...

Kallithea 0.2.9 HTTP Response Splitting

Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd, Free Software source code management system that...

Kallithea 0.2.9 HTTP Response Splitting Vulnerability

Kallithea suffers from a HTTP header injection response splitting vulnerability because it fails to properly sanitize user input before using it as an HTTP header value via the GET 'camefrom' parameter in the login instance. This type of attack not only allows a malicious user to control the...

Kallithea 0.2.9 - 'came_from' HTTP Response Splitting

Kallithea 0.2.9 camefrom HTTP Response Splitting Vulnerability Vendor: Kallithea Product web page: https://www.kallithea-scm.org Version affected: 0.2.9 and 0.2.2 Summary: Kallithea, a member project of Software Freedom Conservancy, is a GPLv3'd, Free Software source code management system that...

CVE-2015-2028

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2015-2028

CVE-2015-2028 is a CRLF injection vulnerability in IBM WebSphere eXtreme Scale, affecting WebSphere eXtreme Scale 7.1.0 up to but not including 7.1.0.3 and 7.1.1 up to but not including 7.1.1.1. A remote attacker can craft a URL to inject arbitrary HTTP headers and perform HTTP response splitting...

Matt Wright FormMail Multiple cross-site scripting (XSS) vulnerabilities (CVE-2009-1776; CVE-2009-1777)

FormMail is prone to an HTTP-response-splitting vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal...

Edimax BR6228nS/BR6228nC - Multiple Vulnerabilities

Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities Date: 01.09.15 Vendor: edimax.com Firmware version: 1.22 Author: Smash Contact: smash at devilteam.pl Few vulnerabilities found in Edimax BR6228nS/BR6228nC router firmware. 1/ Cross Site Scripting Request: POST /goform/formWizSetup HTTP/1...

Edimax BR6228nS/BR6228nC - Multiple vulnerabilities

Exploit for hardware platform in category web applications Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities Date: 01.09.15 Vendor: edimax.com Firmware version: 1.22 Author: Smash Contact: smash at devilteam.pl Few vulnerabilities found in Edimax BR6228nS/BR6228nC router firmware. 1/ Cro...

Edimax BR6228nSBR6228nC - Multiple Vulnerabilities

Edimax BR6228nSBR6228nC - Multiple Vulnerabilities Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities Date: 01.09.15 Vendor: edimax.com Firmware version: 1.22 Author: Smash Contact: smash at devilteam.pl Few vulnerabilities found in Edimax BR6228nS/BR6228nC router firmware. 1/ Cross Site...

CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

CVE-2015-5144

CVE-2015-5144 affects Django prior to 1.4.21, 1.5.x–1.6.x, 1.7.x prior to 1.7.9, and 1.8.x prior to 1.8.3. The root cause is an incorrect regular expression in built‑in validators, enabling remote attackers to inject arbitrary headers and perform HTTP response splitting via newline characters in ...