330 matches found
The vulnerability of the Firefox browser, which allows a violator to obtain confidential information
The vulnerability of the Firefox browser’s URL analysis process is related to the improper recognition of escaped characters in host names within the Location header. Exploiting this vulnerability can allow a malicious actor to access protected information by redirecting users to another website...
CVE-2015-7910
Exemys Telemetry Web Server relies on an HTTP Location header to indicate that a client is unauthorized, which allows remote attackers to bypass intended access restrictions by disregarding this header and processing the response body...
Design/Logic Flaw
Exemys Telemetry Web Server relies on an HTTP Location header to indicate that a client is unauthorized, which allows remote attackers to bypass intended access restrictions by disregarding this header and processing the response body...
CVE-2015-7910
Exemys Telemetry Web Server relies on an HTTP Location header to indicate that a client is unauthorized, which allows remote attackers to bypass intended access restrictions by disregarding this header and processing the response body...
Exemys Telemetry Web Server Authentication Bypass Vulnerability
Exemys Telemetry Web Server is a web-based SCADA system from Exemys Argentina. A security vulnerability exists in Exemys Telemetry Web Server. An attacker can exploit this vulnerability by ignoring the location header to gain direct access to information...
Mozilla Firefox URL parsing implementation information disclosure vulnerability
Mozilla Firefox is an open source web browser. Mozilla Firefox's URL parsing implementation fails to properly recognize the slash character in the hostname in the Location header, allowing remote attackers to exploit this vulnerability to obtain sensitive information...
cacti -- Multiple XSS and SQL injection vulnerabilities
The Cacti Group, Inc. reports: Important Security Fixes Multiple XSS and SQL injection vulnerabilities Changelog bug: Fixed SQL injection VN: JVN78187936 / TN:JPCERT98968540 bug0002542: FG-VD-15-017 Cacti Cross-Site Scripting Vulnerability Notification bug0002571: SQL Injection and Location heade...
Adobe ColdFusion HTTP Response Splitting (APSB12-15) (credentialed check)
The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability. The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker could exploit this by tricking a user...
Scientific Linux Security Update : firefox on SL4.x, SL5.x, SL6.x i386/x86_64
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
Adobe ColdFusion HTTP Response Splitting (APSB12-15)
The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability. The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker can exploit this by tricking a user...
http-apache-negotiation NSE Script
Checks if the target http server has modnegotiation enabled. This feature can be leveraged to find hidden resources and spider a web site using fewer requests. The script works by sending requests for resources like index and home without specifying the extension. If modnegotiate is enabled defau...
DEBIAN-CVE-2011-4138
The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...
PYSEC-2011-3
The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...
Design/Logic Flaw
The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...
CVE-2011-4138
Affected software: Django prior to 1.2.7 and 1.3.x prior to 1.3.1. The verify_exists URLField validation tests a URL with HEAD, but on redirects uses GET to the redirected target, potentially causing unwanted GET requests with an unintended source IP via a crafted Location header. Impact: potenti...
CVE-2011-4138
The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...
CVE-2011-3000
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting...
Firefox < 7.0 Multiple Vulnerabilities
The installed version of Firefox is earlier than 7.0 and thus, is potentially affected by the following security issues : - If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for example, a malicious application or extension could be downloaded and...
Mozilla: Defense against multiple Location headers due to CRLF Injection (MFSA 2011-39)
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting...
Mozilla: Defense against multiple Location headers due to CRLF Injection (MFSA 2011-39)
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting...