Reprise License Manager license editor cross-site scripting vulnerability

Reprise License Manager RLM is a set of license management software from Reprise, Inc. license editor is one of the certificate editors. A cross-site scripting vulnerability exists in the 'lf' parameter of the /goform/editlfgetdata URL of the license editor in Reprise RLM 12.2BL2 and earlier...

Reprise License Manager Arbitrary File Read Vulnerability

Reprise License Manager RLM is a suite of license management software from Reprise, Inc. An arbitrary file read vulnerability exists in Reprise RLM 12.2BL2 and earlier versions, which stems from the fact that by default, the web interface on port 5054 does not require authentication. The...

CVE-2018-15574: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the license editor in Reprise License Manager RLM through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/editlfgetdata lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability."...

CVE-2018-5716: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter "lf" to the goform/editlfgetdata UR...

PT-2018-17108 · Reprise · Reprise License Manager

Name of the Vulnerable Software and Affected Versions: Reprise License Manager version 11.0 Description: A Path Traversal issue allows an attacker to access files on the server's file system by modifying a field in the web request. Specifically, by specifying a pathname in the lf parameter to the...

Response Splitting

HTTP response splitting occurs when untrusted data is inserted into the response headers without any sanitisation. If successful, this allows cyber-criminals to essentially split the HTTP response in two. This is abused by cyber-criminals injecting CR Carriage Return -- /r and LF Line Feed -- \n...

F5 Networks BIG-IP : Apache HTTP server vulnerability (SOL17189)

CRLF injection vulnerability in the modnegotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP respons...

Yahoo!: YQL: From CR/LF injection to root compromise

The Yahoo Query Language YQL allowed sending outgoing HTTP requests; custom headers could be added using the header method. A vulnerability existed wherein CR/LF carriage return/line feed sequences could be injected into these custom headers, enabling HTTP request smuggling attacks. This bypassed...

WebsiteBaker 2.8.3 - Multiple Vulnerabilities

============================================= MGC ALERT 2014-004 - Original release date: March 11, 2014 - Last revised: November 18, 2014 - Discovered by: Manuel Garcia Cardenas - Severity: 10/10 CVSS Base Score ============================================= I. VULNERABILITY...

Fedora 18 : perl-Dancer-1.3100-3.fc18 (2013-9950)

This release fixes CR-LF injection into Cookie HTTP header CVE-2012-5572. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 17 : perl-Dancer-1.3093-3.fc17 (2013-9961)

This release fixes CR-LF injection into Cookie HTTP header CVE-2012-5572. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 19 : perl-Dancer-1.3111-3.fc19 (2013-9918)

This release fixes CR-LF injection into Cookie HTTP header CVE-2012-5572. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

HTTP Protocol header injection vulnerability-vulnerability warning-the black bar safety net

HTTP response header file contains unverified data will lead to cache-poisoning, cross-site scripting, cross-user defacement, page hijacking, cookie manipulation or open redirect. HTTP Protocol header injection vulnerability principles The following cases will appear in the HTTP Protocol header...

Oracle Sun Java System Web Server - HTTP Response Splitting

Exploit for jsp platform in category web applications =========================================================== Oracle Sun Java System Web Server - HTTP Response Splitting =========================================================== Description Security-Assessment.com discovered that is possible...

Oracle Sun Java System Web Server - HTTP Response Splitting

Oracle Sun Java System Web Server - HTTP Response Splitting Description Security-Assessment.com discovered that is possible to successfully perform an HTTP Response Splitting attack against applications served by Sun Java System Web Server. The vulnerability can be exploited if user supplied inpu...

Design/Logic Flaw

The Cisco Content Services Switch CSS 11500 with software 8.20.4.02 and the Application Control Engine ACE 4710 with software A23.0 do not properly handle LF header terminators in situations where the GET line is terminated by CRLF, which allows remote attackers to conduct HTTP request smuggling...

CVE-2010-2629: Improper Input Validation

The Cisco Content Services Switch CSS 11500 with software 8.20.4.02 and the Application Control Engine ACE 4710 with software A23.0 do not properly handle LF header terminators in situations where the GET line is terminated by CRLF, which allows remote attackers to conduct HTTP request smuggling...

cPanel HTTP Response Splitting Vulnerability

No description provided by source. Security Advisory by Trancer January 21 2010 http://www.rec-sec.com "Hacking, however, is an art, not a science." Vendor ------ cPanel Inc. - http://www.cpanel.net Vulnerability Information ------------------------- Application description: "cPanel is the indust...

Fedora 10 : xterm-238-1.fc10 (2009-0091)

This update fixes the following security issue: CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF aka \n characters surrounding a command name within a Device Control Request Status String DECRQSS escape sequence in a text file, a related...

CVE-2008-2383

CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF aka \n characters surrounding a command name within a Device Control Request Status String DECRQSS escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071...