PT-2019-9247

Name of the Vulnerable Software and Affected Versions i-FILTER versions 9.50R05 and earlier Description The issue allows remote attackers to inject arbitrary HTTP headers, potentially leading to HTTP response splitting attacks. This could result in arbitrary script injection or setting arbitrary...

Webgalamb Information Disclosure / XSS / CSRF / SQL Injection

Summary ------- Vendor: E.N.S. Zrt www.ens.hu Product: Webgalamb www.webgalamb.hu, www.facebook.com/webgalamb Webgalamb is a commercial email marketing software for managing subscription lists and sending out bulk emails. It is not SaaS but a PHP based web application that is typically hosted nex...

CVE-2018-4012

An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bchttpreadheader incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud serve...

CVE-2018-4012

An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bchttpreadheader incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud serve...

Buffer overflow

An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bchttpreadheader incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud serve...

PT-2019-10751

Name of the Vulnerable Software and Affected Versions Webroot BrightCloud SDK affected versions not specified Description A buffer overflow issue exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The bc http read header function incorrectly handles overlong headers, which...

CVE-2018-4012: Improper Restriction of Operations within the Bounds of a Memory Buffer

An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bchttpreadheader incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud serve...

CVE-2018-17193

The CVE-2018-17193 issue affects Apache NiFi where the message-page.jsp error page used the HTTP header X-ProxyContextPath without sanitization, enabling a reflected XSS attack. The root cause is unsanitized usage of the request attribute value in that page. The vulnerability is addressed in NiFi...

Kaspersky: Certificate warnings and similar UI elements in Web protection of Anti-Virus products family are susceptible to clickjacking

Summary Clickjacking can be used to trick users into overriding certificate warnings, disabling Safe Money functionality or phishing alerts. Description On certificate warning pages, a single click is sufficient to trigger overriding a wrong certificate. While an additional warning is displayed...

PT-2018-12200

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels 4" - 22" versions prior to V14 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V14 SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V14 SIMATIC WinCC Runtime...

Information Disclosure

urllib3 is vulnerable to Information Disclosure. The library does not remove Authorization HTTP header during a cross-origin redirect, leading to the disclosure of credentials in the Authorization header...

PT-2018-12695

Name of the Vulnerable Software and Affected Versions IBM BigFix Platform versions 9.2.0 through 9.2.14 IBM BigFix Platform versions 9.5 through 9.5.9 Description The issue is caused by improper validation of user-supplied input, allowing a remote attacker to inject arbitrary HTTP headers and cau...

CVE-2018-6703

Use After Free in Remote logging which is disabled by default in McAfee McAfee Agent MA 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sent to the logging service...

CVE-2018-6703 Remote Logging functionality had a use after free vulnerability in McAfee Agent

Use After Free in Remote logging which is disabled by default in McAfee McAfee Agent MA 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sent to the logging service...

CVE-2018-6703: Use After Free

Use After Free in Remote logging which is disabled by default in McAfee McAfee Agent MA 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sent to the logging service...

YunoHost HTTP Header Injection Vulnerability

YunoHost is a Linux-based server operating system. A security vulnerability exists in YunoHost versions 2.7.2 through 2.7.14, which can be exploited by attackers to inject HTTP headers with the help of malicious links, redirect users to malicious websites, cause HTTP response splitting or cache...

JVN#32155106: Multiple vulnerabilities in i-FILTER

i-FILTER provided by Digital Arts Inc. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2018-16180 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 HTTP...

JVN#89767228: Multiple vulnerabilities in multiple SEIKO EPSON printers and scanners

Multiple printers and scanners provided by SEIKO EPSON CORPORATION contain multiple vulnerabilities listed below. Open Redirect CWE-601 - CVE-2018-0688 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N| Base Score: 4.7 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N|...

CVE-2018-11347

The CVE-2018-11347 entry concerns the YunoHost web application (versions 2.7.2 through 2.7.14). Affected component/issue: HTTP Response Header Injection, enabling an attacker to inject one or more HTTP headers in server responses. Attack requirements: user interaction is needed (the attacker must...

PT-2018-10505

Name of the Vulnerable Software and Affected Versions YunoHost versions 2.7.2 through 2.7.14 Description The issue allows an attacker to inject one or several HTTP Header into the response from the server. This requires an interaction with the user to send them a malicious link. It could be used ...