CVE-2009-0868: Improper Input Validation

CRLF injection vulnerability in the WebLink template in Fujitsu Jasmine2000 Enterprise Edition allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

APC PowerChute Network Shutdown - HTTP Response Splitting / Cross-Site Scripting

source: https://www.securityfocus.com/bid/33924/info APC PowerChute Network Shutdown is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...

APC PowerChute Network Shutdown - HTTP Response Splitting Cross-Site Scripting

APC PowerChute Network Shutdown - HTTP Response Splitting Cross-Site Scripting source: https://www.securityfocus.com/bid/33924/info APC PowerChute Network Shutdown is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize...

New vulnerabilities in Relay

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых уязвимостях в движке Relay. Это Directory Traversal и HTTP Response Spliting уязвимости. Обе уязвимости связаны с одной SQL Injection в Relay http://websecurity.com.ua/1485/. Данные две атаки проводятся через SQL инъекцию. Эти уязвимости...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Relay: HTTP response splitting, SQL injection, directory traversal...

Crlf injection

CRLF injection vulnerability in SocialEngine SE 2.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the PHPSESSID cookie...

CVE-2008-6121

CRLF injection vulnerability in SocialEngine SE 2.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the PHPSESSID cookie...

CVE-2008-6121

CVE-2008-6121 describes a CRLF injection vulnerability in SocialEngine versions 2.7 and earlier. The issue allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via the PHPSESSID cookie. Affected software: SocialEngine 2.7 and earlier. Underlying cause: CRLF...

CVE-2008-6121: Improper Input Validation

CRLF injection vulnerability in SocialEngine SE 2.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the PHPSESSID cookie...

USN-717-1: Firefox and Xulrunner vulnerabilities

Several flaws were discovered in the browser engine. These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges. CVE-2009-0352, CVE-2009-0353 A flaw was discovered in the JavaScript engine. An attacker could bypass the same-origin policy i...

Crlf injection

CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-4283

CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-4283

CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-4283

CVE-2008-4283 describes a CRLF injection vulnerability in the WebContainer component of IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions. The issue allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. Accor...

CVE-2008-4283: Improper Input Validation

CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-6059

xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly...

CVE-2008-6059

xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly...

CVE-2009-0357

CVE-2009-0357 affects Mozilla Firefox (before 3.0.6) and SeaMonkey (before 1.1.15). The vulnerability stems from not properly restricting access from web pages to the Set-Cookie/Set-Cookie2 HTTP response headers, allowing an attacker to read cookie data via XMLHttpRequest calls and potentially ex...

CVE-2009-0411

Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script...

Oracle Application Server - multiple security vulnerabilities

Application: Oracle Application Server Versions Affected: Oracle Application Server 10.1.2.0.2 Vendor URL: http://oracle.com Bugs: Response Splitting XSS Exploits: YES Reported: 21.01.2009 Vendor response: 23.01.2009 Date of Public Advisory: 22.02.2012 Author: Alexandr Polyakov Description Oracle...