NetCat CMS HTTP Response Splitting Vulnerability

NetCat CMS is a content management system. NetCat CMS suffers from a response splitting vulnerability that can be exploited by remote attackers to construct special responses that can be used in spoofing and forgery attacks to steal sensitive information...

Varnish Backend Service HTTP Response Parsing Buffer Overflow Vulnerability

Varnish is a high-performance open source HTTP gas pedal . Varnish handles back-end HTTP responses with a buffer overflow vulnerability that allows an attacker to exploit the vulnerability to crash the application or execute arbitrary code...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) in report_story

Hi, I would like to report a HTTP Response Splitting vulnerability in https://twitter.com/i/safety/reportstory that allows attackers to inject arbitrary headers and contents in the response. PoC:...

Loxone Smart Home Miniserver < 6.3 Multiple Vulnerabilities

According to its banner, the remote Loxone Smart Home Miniserver device is a version prior to 6.3. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to the device transmitting all data in cleartext. A remote man-in-the-middle attacker ca...

Varnish Cache 4.03 Buffer Overflow

Hi there, Latest varnish-cache 4.0.3 https://www.varnish-cache.org/ seem to have a problem with parsing HTTP responses from backend. The following example response will trigger a heap buffer overflow : -- cut -- perl -e 'print "HTTP/1.1 200 OK\r\nContent-Length: dupa" . "\n" x 15855 . "A" x 10000...

NetCat CMS 5.01 Header Injection

NetCat CMS Multiple HTTP Response Splitting CRLF Security Vulnerabilities Exploit Title: NetCat CMS Multiple CRLF Security Vulnerabilities Product: NetCat CMS Content Management System Vendor: NetCat Vulnerable Versions: 5.01 3.12 3.0 2.4 2.3 2.2 2.1 2.0 1.1 Tested Version: 3.12 Advisory...

Loxone Smart Home CSRF / XSS / DoS / Credential Leakage

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware: 5.49; Android-App: 3.4.1 fixed version: 6.3 impact: High homepage: http://www.loxone.com...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

Crlf injection

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

JVN#64455813: Squid input validation vulnerability

Squid is a caching proxy server. Squid contains a vulnerability where server responses that contain invalid values in the Content-Length of the HTTP header are sent to the client. Impact If a HTTP response with a specially crafted header is processed, it may result in a HTTP response splitting...

CVE-2014-4803

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

Crlf injection

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

CVE-2014-4803

IBM Cúram Universal Access (part of IBM Cúram Social Program Management) is vulnerable to a CRLF injection when not deployed on WebSphere, due to improper sanitization on a page parameter. A remote authenticated attacker could inject arbitrary HTTP headers and perform HTTP response splitting, pot...

CVE-2014-4803

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

openSUSE Security Update : curl (openSUSE-2015-125)

was updated to version 7.40.0 to fix two security issues. These security issues were fixed : - CVE-2014-8150: CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allowed remote attackers to inject arbitrary HTTP headers and conduct HTTP response...

CVE-2015-1469

time.htm in the web interface on SerVision HVG Video Gateway devices with firmware through 2.2.26a100 allows remote authenticated users to gain privileges by leveraging a cookie received in an HTTP response, a different vulnerability than CVE-2015-0929 and CVE-2015-0930...

CVE-2015-0929

time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response...