HTTP Header Injection

stanford-corenlp is vulnerable to HTTP header injection. The addResults function of NERServlet.java does not properly validate the data in an HTTP response, allowing an attacker to inject malicious headers in requests...

Improper access control

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java lines 158 and 159...

CVE-2021-44550

CVE-2021-44550 corresponds to an Incorrect Access Control vulnerability in Stanford CoreNLP 4.3.2, exposed via the NERServlet classifier. The issue enables HTTP header injection by not properly validating or escaping the classifier header, allowing a remote attacker to craft requests that inject ...