3912 matches found
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443: Improper Neutralization of CRLF Sequences in HTTP Headers
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
PT-2017-17740
Name of the Vulnerable Software and Affected Versions apt-cacher versions prior to 1.7.15 apt-cacher-ng versions prior to 3.4 Description The issue is related to HTTP response splitting via encoded newline characters. This is due to the lack of blocking for the %0ad regular expression, which can ...
Computer Associates (Layer7) API Gateway 7 / 8 / 9 CRLF Response Splitting / Directory Traversal
https://www.osisecurity.com.au/computer-associates-api-gateway-crlf-response-splitting-directory-traversal-vulnerabilities.html Date: 04-Apr-2017 Product: Computer Associates Layer7 API Gateway Versions affected: v7, v8, v9 Vulnerabilities: 1 CRLF Response Splitting...
Chimein.mozilla.org Cross Site Scripting
Exploit Title: Mozilla.org sub-domain Stored-XSS - Reflected-XSS - HTTP Response Splitting Date: 03/04/2017 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.mozilla.org Version: / Category: Stored Cross Site Scripting / Reflected Cross Site Scripting / HTTP Response Splitting...
MODX Revolution 'setup/controllers/language.php' file HTTP response splitting vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/controllers/language.php file in MODX Revolution 2.5.4-pl a...
Response Splitting
HTTP response splitting occurs when untrusted data is inserted into the response headers without any sanitisation. If successful, this allows cyber-criminals to essentially split the HTTP response in two. This is abused by cyber-criminals injecting CR Carriage Return -- /r and LF Line Feed -- \n...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
Code injection
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
MODX Revolution 2.5.4-pl and earlier are affected by a vulnerability in setup/controllers/language.php where the language parameter is not properly constrained. An attacker can supply an invalid value to trigger a Cookie-Bombing denial of service (cookie quota exhaustion) and can also perform HTT...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
PT-2017-17664
Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to conduct attacks, potentially leading to a denial of service due to cookie quota exhaustion or HTTP Response Splitting attacks, which can result in...
CVE-2017-7320: Improper Neutralization of Input During Web Page Generation
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
HackerOne: CRLF injection in info.hacker.one
Vulnerable URL: info.hacker.one Vulnerability description This script is possibly vulnerable to CRLF injection attacks. HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly...
Debian DLA-873-1 : apt-cacher security update
It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 'Wheezy', this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We recommend that you upgrade your apt-cacher packages. NOTE: Tenabl...
[SECURITY] [DLA 873-1] apt-cacher security update
Package : apt-cacher Version : 1.7.6+deb7u1 Debian Bug : 858739 It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 "Wheezy", this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We...
F5 Networks BIG-IP : Node.js vulnerability (K23134279)
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as...