CVE-2015-1445: Improper Neutralization of CRLF Sequences in HTTP Headers

HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...

PT-2017-6491

Name of the Vulnerable Software and Affected Versions fli4l versions prior to 3.10.1 fli4l versions 4.0 before 2015-01-30 Description The issue concerns HTTP header injection in the httpd package. Recommendations For fli4l versions prior to 3.10.1, update to version 3.10.1 or later. For fli4l...

PT-2017-6364

Name of the Vulnerable Software and Affected Versions IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware versions prior to 3.4.1110 Description The issue allows remote attackers to inject arbitrary HTTP headers, which can lead to HTTP response splitting attacks. This...

In a remote sandbox, free to soar: Adobe Flash Windows user credentials disclosure vulnerability-vulnerability warning-the black bar safety net

One, Foreword Recently, I published about the Flash sandbox escape vulnerabilities of an article, The final result has survived ten years of the Flash Player local security sandbox died a natural death. Before this vulnerability to show us the input data to verify the correctness of importance. T...

CVE-2017-12650

CVE-2017-12650 affects the WordPress Loginizer plugin prior to version 1.3.6. The root cause is improper sanitization of the X-Forwarded-For HTTP header, which is forwarded to the lz_selectquery() function and can be exploited to perform a blind SQL injection via the login workflow. Impact stated...

CVE-2017-12650

SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header...

Open Redirect

rails is vulnerable to open redirects. The X-Forwarded-Host HTTP header is always trusted, allowing a malicious user to pass an invalid host header to redirect a user to a malicious URL...

CVE-2017-9764

Cross-site scripting XSS vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action...

Cross site scripting

Cross-site scripting XSS vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action...

CVE-2017-9764

Cross-site scripting XSS vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action...

CVE-2017-9764

MetInfo CMS 5.3.17 contains a cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web script or HTML by sending crafted Client-IP or X-Forwarded-For HTTP headers to /include/stat/stat.php with a para action. Multiple connected sources (CNVD-2017-25435, CVE/NVD entries)...

CVE-2017-1000059

Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users...

CVE-2017-1000059

Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users...

Cross site scripting

Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users...

CVE-2017-1000059: Improper Neutralization of Input During Web Page Generation

Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users...

CVE-2017-1000059

Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users...

PT-2017-10768

Name of the Vulnerable Software and Affected Versions Live Helper Chat versions 2.06v and older Description The issue allows for Cross-Site Scripting in the HTTP Header handling, resulting in the execution of any user-provided Javascript code in the session of other users. Recommendations For...

RaidenHTTPD 2.0.44 User-Agent Cross Site Scripting

Exploit Title: RaidenHTTPD 2.0.44 - User-Agent - HTML Injection & Cross-site scripting Exploit Author: sultan albalawi :@bofheaded :https://hackinguyz.blogspot.com/ exploit User-Agent HTTP header : For remote testing use http-live -There is no need to use the script alertdocument.cookiewxo3i...

Yaws 2.0 Cross Site Scripting

Exploit Title: Yaws 2.0 server - Cross-Site Scripting Exploit Author: sultan albalawi :@bofheaded :https://hackinguyz.blogspot.com/ ............................. D0rk= inurl:/arg.yaws path: http://site/arg.yaws http heders User-Agent | | | v Host: http://site/ User-Agent: Mozilla/5.0 Windows NT...

WakaTime: Unsafe Inline and Eval CSP Usage

Hi Team, The HTTP header of the wakatime.com website includes an unsafe CSP parameter for "script-src". Impact: However, the "script-src" parameter is set to "unsafe-inline" or "unsafe-eval", which allows injection of user passed values, which in result can be misused for Cross-Site Scripting...