CVE-2025-53094

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF Carriage Return Line Feed injection vulnerability exists in the construction and output of HTTP headers within AsyncWebHeader.cpp. Unsanitize...

CVE-2025-53094 ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF Carriage Return Line Feed injection vulnerability exists in the construction and output of HTTP headers within AsyncWebHeader.cpp. Unsanitize...

CVE-2022-43420

Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control or modify Contrast service API responses...

CVE-2022-24322

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data...

CVE-2025-4979

Removed by vendor...

CVE-2019-18632

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate...

CVE-2024-6199

An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS DDNS traffic between DDNS services and the modem, could manipulate specific responses to include code that forces a buffer overflow on the modem. Customers that have not enabled Dynamic DNS on their modem...

CVE-2025-25535

HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request...

CVE-2025-25535

HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request...

CVE-2025-25535

CVE-2025-25535 concerns ScriptCASE (SCRIPT CASE) v1.0.002 Build7, where HTTP response manipulation is reported to allow a remote attacker to escalate privileges via a crafted request. The connected sources consistently attribute the issue to HTTP response manipulation within the ScriptCASE build,...

CVE-2025-25535

HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request...

Scriptcase 安全漏洞

Scriptcase is a low-code platform for rapid application development from Scriptcase, Inc. A security vulnerability exists in Scriptcase version v.1.0.002 Build 7, which stems from HTTP response manipulation and could lead to elevation of privilege...

CVE-2025-25535

HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request...

CVE-2024-57778

CVE-2024-57778 affects the Orbe ONetView Onet-1200 router. The issue allows a remote attacker to escalate privileges by exploiting a server response flow that changes from HTTP 500 to HTTP 200. Documents consistently describe the affected device as Orbe ONetView Roeador Onet-1200/Onet-1200 and in...

U.S. Dept Of Defense: 2FA Bypass via Response Manipulation on Login Page

A vulnerability was discovered in the Two-Factor Authentication 2FA mechanism of the website. The vulnerability allowed bypassing the 2FA verification process by intercepting and manipulating the server's response. As a result, an attacker could gain unauthorized access to an account after...

CVE-2025-23054 Authenticated Response Manipulation allows Unauthorized Actions in Management Interface

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files,...

CVE-2025-23054

CVE-2025-23054 affects the web-based management interface of HPE Aruba Networking Fabric Composer. It describes an authenticated low-privilege operator who can perform operations outside their privilege level, potentially leading to manipulation of user-generated files and unauthorized changes to...

USN-6988-1 twisted vulnerabilities

Ben Kallus discovered that Twisted incorrectly handled response order when processing multiple HTTP requests. A remote attacker could possibly use this issue to delay and manipulate responses. This issue only affected Ubuntu 24.04 LTS. CVE-2024-41671 It was discovered that Twisted did not properl...

U.S. Dept Of Defense: Improper Authentication Allows Making Appeals as Other Users

The vulnerability allowed unauthenticated users to submit appeals by manipulating HTTP responses. This undermined the security and integrity of the application, as users could perform actions reserved for logged-in users...

U.S. Dept Of Defense: Improper Authentication Allows Making Requests as Other Users

A vulnerability was discovered that allowed unauthenticated users to submit requests as other users by manipulating HTTP responses. The vulnerability was caused by the application's failure to enforce strict authentication checks on sensitive endpoints, and its inability to properly validate serv...