Cisco EPC 3925 - Multiple Vulnerabilities

Cisco EPC 3925 - Multiple Vulnerabilities Title: Cisco EPC 3925 Multiple Vulnerabilities Vendor: http://www.cisco.com/ Vulnerable Versions: Cisco EPC3925 EuroDocsis 3.0 2-PORT Voice Gateway Date: 15.09.2016 Author: Patryk Bogdan ======== Vulnerability list: 1. HTTP Response Injection via 'Lang'...

Cisco EPC 3925 - Multiple Vulnerabilities

Title: Cisco EPC 3925 Multiple Vulnerabilities Vendor: http://www.cisco.com/ Vulnerable Versions: Cisco EPC3925 EuroDocsis 3.0 2-PORT Voice Gateway Date: 15.09.2016 Author: Patryk Bogdan ======== Vulnerability list: 1. HTTP Response Injection via 'Lang' Cookie 2. DoS via 'Lang' Cookie 3. DoS in...

Infoblox Network Automation HTTP Response Splitting Vulnerability

Infoblox Network Automation is a suite of automated network configuration and change management software from Infoblox USA. An HTTP response splitting vulnerability exists in Infoblox Network Automation versions 7.0.1 and 6.9.2, which can be exploited by an attacker to affect or tamper with web...

CVE-2016-6839

CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-6839

CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-6839

The CVE is tied to Huawei FusionAccess prior to V100R006C00, where an HTTP header injection vulnerability (CRLF injection) allows a remote, unauthenticated attacker to tamper with server responses and inject arbitrary HTTP headers, enabling HTTP response splitting via unspecified vectors. Connect...

Infoblox 7.0.1 CRLF Injection / HTTP Response Splitting

Exploit Title: CVE-2016-6484 Infoblox Network Automation CRLF Injection/ HTTP splitting vulnerability Product: Infoblox Network Automation Vulnerable Versions: 7.0.1 and all previous versions Tested Version: 6.9.2 Advisory Publication: 06/09/2016 Vulnerability Type: CWE-113: Improper Neutralizati...

IBM WebSphere Application Server Information Disclosure Vulnerability (swg21982588)

IBM WebSphere Application Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)

This update for squid3 fixes the following issues : - Multiple issues in pinger ICMP processing. CVE-2014-7141, CVE-2014-7142 - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. bsc973782 - CVE-2016-4554: fix header smuggling issue in HTTP Request processing bsc979010 - fix multipl...

QIWI: [lk.contact-sys.com] SQL Injection reset_password FP_LK_USER_LOGIN

Steps to reproduce 1 Открыть https://lk.contact-sys.com/index.php/LK/login 2 Нажать "Забыли пароль?" 3 Заполнить форму Код Участника: test Логин: ' and @@version=1 and '1'='1 HTTP Request http POST /index.php/LK/resetpassword HTTP/1.1 Host: lk.contact-sys.com Content-Type:...

QIWI: [wallet.rapida.ru] XSS Cookie flashcookie

Steps to reproduce 1 Заражаем cookie пользователя. Можно использовать Cookie Injection, XSS или CRLF Injection на .rapida.ru Так как используется Django и не самый свежий Python, то возможно сделать Cookie Injection через Google Analytics тут расписана эта атака https://habrahabr.ru/post/272187/...

How content-length of a HTTP response is handled when rewrite is in use on NetScaler

When using rewrite policy with priority 120 on NetScaler it can be noticed that Content-Length header is misspelled in the response. To alter this behavior we can use another rewrite policywith priority 100 that has an action that can never be true. Note: Priority 120 and 100 is taken as examples...

QIWI: [ibank.qiwi.ru] XSS via Request-URI

PoC Internet Explorer и, может быть, Edge https://blackfan.ru/x?r=https://ibank.qiwi.ru/xx'-alertdocument.domain-'xx/%252e%252e/webbanking/sessiontimeout.jsf blackfan.ru/x?r простой скрипт перенаправления, необходимый для формирования Request-URI и обхода XSS фильтра IE. HTTP Response //...

tcPbX - tcpbx_lang Local File Inclusion

tcPbX - tcpbxlang Local File Inclusion Vulnerable hardware : tcpbx voip distro Vendor : www.tcpbx.org Author : Ahmed sultan @0x4148 Email : [email protected] Summary : According to the vendor's site , tcPbX is a complete and functional VoIP phone system based on Asterisk open source software and...

openSUSE Security Update : squid (openSUSE-2016-988)

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues : - Fixed multiple Denial of Service issues in HTTP Response processing. CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc968392, bsc968393, bsc968394, bsc968395 - CVE-2016-3947: Buffer...

Silver Stripe CMS: source code security analysis report

Several vulnerabilities were discovered in SilverStripe Limited 'Silver Stripe CMS' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Incorrect Newlin...

VMware vCenter Server/ESXi CRLF Injection Vulnerability

VMware vCenter Server enables rapid deployment of virtual machines and monitors the performance of physical servers and virtual machines. A CRLF injection vulnerability exists in VMware vCenter Server U2 prior to version 6.0 and ESXi 6.0, which can be exploited by remote attackers to inject...

CVE-2016-5331

CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2016-5331

CVE-2016-5331 describes a CRLF/HTTP header injection vulnerability in VMware vCenter Server 6.0 (before U2) and ESXi 6.0. The underlying issue is CRLF injection that allows remote attackers to manipulate HTTP headers and perform HTTP response splitting via unspecified vectors. Impact is stated as...