2455 matches found
httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
It was found that Apache was vulnerable to a HTTP response splitting attack for sites which use moduserdir. An attacker could use this flaw to inject CRLF characters into the HTTP header and could possibly gain access to secure data...
MODX CMS 2.x < 2.5.5 Multiple Vulnerabilities
MODX CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; ifdescription...
Code injection
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443
CVE-2017-7443 affects apt-cacher (before 1.7.15) and apt-cacher-ng (before 3.4). The issue is HTTP response splitting through encoded newline characters due to missing blocking for the %0[ad] regex. Impact is HTTP header injection risk as described in multiple sources (NVD entry). Remediation: up...
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
Chimein.mozilla.org Cross Site Scripting
Exploit Title: Mozilla.org sub-domain Stored-XSS - Reflected-XSS - HTTP Response Splitting Date: 03/04/2017 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.mozilla.org Version: / Category: Stored Cross Site Scripting / Reflected Cross Site Scripting / HTTP Response Splitting...
MODX Revolution 'setup/controllers/language.php' file HTTP response splitting vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/controllers/language.php file in MODX Revolution 2.5.4-pl a...
Code injection
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
MODX Revolution 2.5.4-pl and earlier are affected by a vulnerability in setup/controllers/language.php where the language parameter is not properly constrained. An attacker can supply an invalid value to trigger a Cookie-Bombing denial of service (cookie quota exhaustion) and can also perform HTT...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
HackerOne: CRLF injection in info.hacker.one
Vulnerable URL: info.hacker.one Vulnerability description This script is possibly vulnerable to CRLF injection attacks. HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly...
Debian DLA-873-1 : apt-cacher security update
It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 'Wheezy', this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We recommend that you upgrade your apt-cacher packages. NOTE: Tenabl...
[SECURITY] [DLA 873-1] apt-cacher security update
Package : apt-cacher Version : 1.7.6+deb7u1 Debian Bug : 858739 It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 "Wheezy", this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We...