CVE-2015-0733

Cisco Headend System Release Digital Broadband Delivery System is affected by a CRLF injection vulnerability in the HTTP Header Handler, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response-splitting attacks (potentially enabling XSS). The issue, tracked as CVE-201...

Cisco Headend Digital Broadband Delivery System HTTP Response-Splitting Vulnerability

A vulnerability in the Cisco Headend Digital Broadband Delivery System could allow an unauthenticated, remote attacker to conduct HTTP response-splitting attacks. The vulnerability is due to improper sanitization on user input performed by the HTTP Header Handler within the affected software...

Fedora 21 : php-ZendFramework2-2.3.8-1.fc21 (2015-7687)

ZF2015-04: Zend\Mail and Zend\Http were both susceptible to CRLF Injection Attack vectors for HTTP, this is often referred to as HTTP Response Splitting. Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding...

SEC Consult SA-20150514-0 :: Multiple vulnerabilities in Loxone Smart Home (part 2)

SEC Consult Vulnerability Lab Security Advisory 20150514-0 ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware version 6.4.5.12 fixed version: 6.4.5.12 impact: Critical homepage:...

Loxone Smart Home XSS / DoS / Access Control

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware version 6.4.5.12 fixed version: 6.4.5.12 impact: Critical homepage: http://www.loxone.com...

Zend Framework HTTP Response Separation Vulnerability

Zend Framework ZF is an open source PHP5 development framework for developing web programs and services. An HTTP response separation vulnerability exists in Zend Framework due to the program failing to properly filter certain inputs. This allows an attacker to insert arbitrary HTTP headers and...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) due to headers overflow

Hi, I would like to report another HTTP Response Splitting vulnerability caused by header fields "overflow" that allows attackers to inject arbitrary headers in the response. Note that this issue is similar to 52042 but the root cause is different. Also, the below PoC is not the only affected pag...

SEC Consult SA-20150227-0 :: Multiple vulnerabilities in Loxone Smart Home

SEC Consult Vulnerability Lab Security Advisory 20150227-0 ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware: 5.49; Android-App: 3.4.1 fixed version: 6.3 impact: High homepage:...

NetCat CMS HTTP Response Splitting Vulnerability

NetCat CMS is a content management system. NetCat CMS suffers from a response splitting vulnerability that can be exploited by remote attackers to construct special responses that can be used in spoofing and forgery attacks to steal sensitive information...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) in report_story

Hi, I would like to report a HTTP Response Splitting vulnerability in https://twitter.com/i/safety/reportstory that allows attackers to inject arbitrary headers and contents in the response. PoC:...

Loxone Smart Home Miniserver < 6.3 Multiple Vulnerabilities

According to its banner, the remote Loxone Smart Home Miniserver device is a version prior to 6.3. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to the device transmitting all data in cleartext. A remote man-in-the-middle attacker ca...

NetCat CMS 5.01 Header Injection

NetCat CMS Multiple HTTP Response Splitting CRLF Security Vulnerabilities Exploit Title: NetCat CMS Multiple CRLF Security Vulnerabilities Product: NetCat CMS Content Management System Vendor: NetCat Vulnerable Versions: 5.01 3.12 3.0 2.4 2.3 2.2 2.1 2.0 1.1 Tested Version: 3.12 Advisory...

Loxone Smart Home CSRF / XSS / DoS / Credential Leakage

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware: 5.49; Android-App: 3.4.1 fixed version: 6.3 impact: High homepage: http://www.loxone.com...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

Crlf injection

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

JVN#64455813: Squid input validation vulnerability

Squid is a caching proxy server. Squid contains a vulnerability where server responses that contain invalid values in the Content-Length of the HTTP header are sent to the client. Impact If a HTTP response with a specially crafted header is processed, it may result in a HTTP response splitting...

CVE-2014-4803

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...