CVE-2024-24919-Bulk-Scanner

Escáner Masivo CVE-2024-24919 CVE-2024-24919 Divulgación de Información de Check Point Security Gateway Script basado en y el crédito va para: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ Este script de Python escanea una lista de URLs en busca de la vulnerabilidad...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: Inyección de cabeceras de respuesta HTTP CRLF en el servidor de streaming de Mastodon Descripción general de la vulnerabilidad...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

Aviso de seguridad: División de respuesta HTTP mediante valores de cabecera de respuesta no validados rouille ID de CVE asignado: CVE-2026-66746 Resumen rouille escribe los valores de las cabeceras de respuesta al cliente sin comprobar si contienen retorno de carro o salto de línea. Una aplicació...

UBUNTU-CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-27944

CVE-2026-27944 - Descarga y Descifrado de Copia de Seguridad No Autenticado en Nginx UI https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red Un exploit de prueba de concepto PoC para CVE‑2026‑27944, una...

CVE-2023-35813

CVE-2023-35813 CVE-2023-35813 es una prueba de concepto utilizada para determinar si una instancia de Sitecore es vulnerable analizando un Encabezado de respuesta del servidor en busca de modificaciones. Hecho con amor por heretic 3...

CVE-2017-1000486

CVE-2017-1000486 Exploit de ejecución remota de código para PrimeFaces 5.x - Inyección de EL CVE-2017-1000486 Básicamente es el mismo exploit creado por Mogwailabs, pero modificado para funcionar en entornos cerrados sin acceso a internet o con tráfico saliente bloqueado por el firewall. Te da lo...

Astra Linux - Vulnerability in Squid

A vulnerability was discovered in Squid 4.x versions prior to 4.15 and 5.x versions prior to 5.0.6. If a remote server sends a specific response header via HTTP or HTTPS, it results in a denial of service. This header could plausibly occur in normal network traffic...

Astra Linux – Vulnerability in Apache2

Before Apache HTTP Server 2.4.55, a malicious backend could cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers serve any security purposes, they will not be interpreted by the client...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

httpc memory exhaustion via unbounded response header accumulation

...

Security Bulletin: XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36431)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability. Vulnerability Details CVEID:CVE-2025-36431 DESCRIPTION: IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site...

CVE-2026-48769

A flaw was found in Incus, a container and virtual machine manager. A malicious image server can cause the Incus client to write files to arbitrary locations via a crafted response header, potentially leading to command execution as root. Mitigation No mitigation is needed as Incus is not shipped...

CVE-2026-71572

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

CVE-2026-71572 Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

CVE-2026-71572

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

UBUNTU-CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879 Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...