4107 matches found
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
Computer Associates (Layer7) API Gateway 7 / 8 / 9 CRLF Response Splitting / Directory Traversal
https://www.osisecurity.com.au/computer-associates-api-gateway-crlf-response-splitting-directory-traversal-vulnerabilities.html Date: 04-Apr-2017 Product: Computer Associates Layer7 API Gateway Versions affected: v7, v8, v9 Vulnerabilities: 1 CRLF Response Splitting...
Chimein.mozilla.org Cross Site Scripting
Exploit Title: Mozilla.org sub-domain Stored-XSS - Reflected-XSS - HTTP Response Splitting Date: 03/04/2017 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.mozilla.org Version: / Category: Stored Cross Site Scripting / Reflected Cross Site Scripting / HTTP Response Splitting...
MODX Revolution 'setup/controllers/language.php' file HTTP response splitting vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/controllers/language.php file in MODX Revolution 2.5.4-pl a...
Response Splitting
HTTP response splitting occurs when untrusted data is inserted into the response headers without any sanitisation. If successful, this allows cyber-criminals to essentially split the HTTP response in two. This is abused by cyber-criminals injecting CR Carriage Return -- /r and LF Line Feed -- \n...
Code injection
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7320
MODX Revolution 2.5.4-pl and earlier are affected by a vulnerability in setup/controllers/language.php where the language parameter is not properly constrained. An attacker can supply an invalid value to trigger a Cookie-Bombing denial of service (cookie quota exhaustion) and can also perform HTT...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
HackerOne: CRLF injection in info.hacker.one
Vulnerable URL: info.hacker.one Vulnerability description This script is possibly vulnerable to CRLF injection attacks. HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly...
Debian DLA-873-1 : apt-cacher security update
It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 'Wheezy', this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We recommend that you upgrade your apt-cacher packages. NOTE: Tenabl...
[SECURITY] [DLA 873-1] apt-cacher security update
Package : apt-cacher Version : 1.7.6+deb7u1 Debian Bug : 858739 It was discovered that there was a HTTP response splitting vulnerability in apt-cacher, a proxy server for Debian/Ubuntu software repositories. For Debian 7 "Wheezy", this issue has been fixed in apt-cacher version 1.7.6+deb7u1. We...
IBM WebSphere Application Server 8.0.0.x < 8.0.0.13 Multiple Vulnerabilities
Binary data 700016.prm...
F5 Networks BIG-IP : Node.js vulnerability (K23134279)
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as...
Blockchain: HTTP Header Injection/HTTP_Response_Splitting
Submitter observed that CloudFlare-protected sites will serve content from other CloudFlare-protected sites when the "Host" HTTP request header is modified in transit. A PoC for an attacker to modify a victim user's "Host" HTTP request header could not be presented by the submitter; consequently...
[SECURITY] [DLA 841-1] apache2 security update
Package : apache2 Version : 2.2.22-13+deb7u8 CVE ID : CVE-2016-8743 This upload fixes a security vulnerability in the header parsing code. David Dennerline, of IBM Securitys X-Force Researchers, and Régis Leroy discovered problems in the way Apache handled a broad pattern of unusual whitespace...
Debian DSA-3796-1 : apache2 - security update
Several vulnerabilities were discovered in the Apache2 HTTP server. - CVE-2016-0736 RedTeam Pentesting GmbH discovered that modsessioncrypto was vulnerable to padding oracle attacks, which could allow an attacker to guess the session cookie. - CVE-2016-2161 Maksim Malyutin discovered that malicio...