CVE-2012-3333

CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL...

Crlf injection

CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL...

CVE-2012-3333

CVE-2012-3333 affects IBM Maximo Asset Management and SmartCloud Control Desk via a CRLF injection that allows HTTP header manipulation and HTTP response splitting through crafted URL parameters. Affected products include Maximo Asset Management and related variants across 7.5/7.1/6.2 lines and S...

[CVE-2014-2206] GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution

RCE Security Advisory http://www.rcesecurity.com 1. ADVISORY INFORMATION ----------------------- Product: GetGo Download Manager Vendor URL: www.getgosoft.com Type: Stack-based Buffer Overflow CWE-121 Date found: 2014-02-20 Date published: 2014-03-02 CVSSv2 Score: 10,0 AV:N/AC:L/Au:N/C:C/I:C/A:C...

CVE-2014-1956

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2014-1956

CVE-2014-1956 describes a CRLF injection in Fortinet FortiWeb prior to version 5.0.3, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. The vulnerability is documented across multiple sources (NVD entry and FortiGuard FG-IR-13-...

Localize: Uninitialized variable error message leaks information

An uninitialized variable $alert at line 630 in index.php shows an error message. This happens after a POST /pages/createproject. The error message does not appear in the browser because the user is redirected to the new project immediately, but it is there in the HTTP response see error.png. Thi...

IBM WebSphere Portal Unspecified HTTP Response Splitting (PM85071)

The version of WebSphere Portal on the remote host is affected by an HTTP response splitting vulnerability. An attacker could insert arbitrary HTTP headers that could allow the attacker to inject additional headers in order to manipulate cookies. %NASLMINLEVEL 70300 C Tenable Network Security, In...

CVE-2013-1869

CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network RHN Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting XSS attacks, via the returnurl parameter...

CVE-2013-1869

CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network RHN Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting XSS attacks, via the returnurl parameter...

CVE-2013-1869

CVE-2013-1869 affects spacewalk-java before 2.1.148-1 and Red Hat Network Satellite 5.6, allowing remote header injection via the return_url parameter that can enable HTTP response splitting and XSS. Responsible updates are in RHSA-2014:0148 (spacewalk-java, spacewalk-web, satellite-branding); ap...

CVE-2013-3998

CRLF injection vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2013-3998

CRLF injection vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2013-3998

CVE-2013-3998 affects IBM InfoSphere BigInsights Web Application Enterprise Console (versions 1.1–2.1). The root cause is a CRLF injection that allows remote authenticated users to inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. Impact stated in sources ...

OXID eShop 'index.php'多个HTTP应答拆分漏洞

Bugtraq ID:66371 CVE ID:CVE-2014-2017 OXID eShop又名OXID eSales是一个e-commerce系统,采用PHP开发,使用MySQL来存储数据。 通过"anid", "cnid"和"listtype"参数传递给index.php的输入在用于限制HTTP头字段时缺少过滤，允许远程攻击者利用漏洞把包含任意HTTP头的应答发送给用户。 0 OXID eShop 4.x OXID eShop 5.x OXID eShop Professional, Community或Enterprise version 4.7.11/5.0.11 and...

OXID eShop < 4.7.11/5.0.11 / < 4.8.4/5.1.4 - Multiple Vulnerabilities

Exploit Title: OXID eShop v4.7.11/5.0.11 + v4.8.4/5.1.4 Multiple Vulnerabilities Google Dork: - Date: 12/2013 Exploit Author: //sToRm Author mail: [email protected] Vendor Homepage: http://www.oxid-esales.com Software Link: - Version: All versions 4.7.11/5.0.11 + All versions 4.8.4/5.1....

OXID eShop XSS / CRLF Injection

Exploit Title: OXID eShop v4.7.11/5.0.11 + v4.8.4/5.1.4 Multiple Vulnerabilities Google Dork: - Date: 12/2013 Exploit Author: //sToRm Author mail: [email protected] Vendor Homepage: http://www.oxid-esales.com Software Link: - Version: All versions 4.7.11/5.0.11 + All versions 4.8.4/5.1....

OkCupid: Security issue in OkCupid

I come across security issue in OkCupid. OkCupid is using Components with Known Vulnerabilities. Link: http://www.okcupid.com/ Criticality level: Medium Each http response shows server information Version, which is not useful to user and browser. But same can be useful to attacker. Description :...