CVE-2017-7320

setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...

PT-2017-17664

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to conduct attacks, potentially leading to a denial of service due to cookie quota exhaustion or HTTP Response Splitting attacks, which can result in...

CVE-2017-7320: Improper Neutralization of Input During Web Page Generation

setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...

HackerOne: CRLF injection in info.hacker.one

Vulnerable URL: info.hacker.one Vulnerability description This script is possibly vulnerable to CRLF injection attacks. HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly...

Debian DLA-873-1 : apt-cacher security update

It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 'Wheezy', this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We recommend that you upgrade your apt-cacher packages. NOTE: Tenabl...

[SECURITY] [DLA 873-1] apt-cacher security update

Package : apt-cacher Version : 1.7.6+deb7u1 Debian Bug : 858739 It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 "Wheezy", this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We...

IBM WebSphere Application Server 8.0.0.x < 8.0.0.13 Multiple Vulnerabilities

Binary data 700016.prm...

Blockchain: HTTP Header Injection/HTTP_Response_Splitting

Submitter observed that CloudFlare-protected sites will serve content from other CloudFlare-protected sites when the "Host" HTTP request header is modified in transit. A PoC for an attacker to modify a victim user's "Host" HTTP request header could not be presented by the submitter; consequently...

Apache Tomcat 8.5.x < 8.5.8 / 9.0.0.x < 9.0.0.M13 Multiple Vulnerabilities

Binary data 9906.pasl...

CVE-2016-6484

CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf...

Crlf injection

CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf...

CVE-2016-6484

CVE-2016-6484 affects Infoblox Network Automation NetMRI prior to 7.1.1. The vulnerability is a CRLF injection in the contentType parameter used in the login action at config/userAdmin/login.tdf, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting. Publi...

PT-2017-8981

Name of the Vulnerable Software and Affected Versions Infoblox Network Automation NetMRI versions prior to 7.1.1 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to...

CVE-2016-6484: Improper Neutralization of CRLF Sequences

CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf...

nodejs: reason argument in ServerResponse#writeHead() not properly validated

It was found that the reason argument in ServerResponsewriteHead was not properly validated. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request...

Important: Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update

An update for rh-nodejs4-nodejs and rh-nodejs4-http-parser is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

McAfee Virus Scan Enterprise For Linux Remote Code Execution

Source: https://nation.state.actor/mcafee.html Vulnerabilities CVE-2016-8016: Remote Unauthenticated File Existence Test CVE-2016-8017: Remote Unauthenticated File Read with Constraints CVE-2016-8018: No Cross-Site Request Forgery Tokens CVE-2016-8019: Cross Site Scripting CVE-2016-8020:...

McAfee VirusScan Enterprise for Linux <= 2.0.3 Multiple vulnerabilities (SB10181)

The remote host has a version of McAfee VirusScan Enterprise for Linux VSEL installed that is prior or equal to 2.0.3. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the web interface due to improper error reporting. An authenticated,...

McAfee Virus Scan Enterprise for Linux - Remote Code Execution Exploit

Exploit for linux platform in category remote exploits ''' Source: https://nation.state.actor/mcafee.html Vulnerabilities CVE-2016-8016: Remote Unauthenticated File Existence Test CVE-2016-8017: Remote Unauthenticated File Read with Constraints CVE-2016-8018: No Cross-Site Request Forgery Tokens...

McAfee Virus Scan Enterprise for Linux 1.9.2 < 2.0.2 - Remote Code Execution

''' Source: https://nation.state.actor/mcafee.html Vulnerabilities CVE-2016-8016: Remote Unauthenticated File Existence Test CVE-2016-8017: Remote Unauthenticated File Read with Constraints CVE-2016-8018: No Cross-Site Request Forgery Tokens CVE-2016-8019: Cross Site Scripting CVE-2016-8020:...