SAP Web Application Server 6.x7.0 - Input Validation

SAP Web Application Server 6.x7.0 - Input Validation source: https://www.securityfocus.com/bid/18006/info SAP Web Application Server is prone to an input-validation vulnerability that results in HTTP response-splitting attacks. This issue is due to a failure in the application to properly sanitiz...

Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : apache (SSA:2005-310-04)

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix potential security issues: If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks. Added...

PHP Handicapper - Process_signup.php HTTP Response Splitting

PHP Handicapper - Processsignup.php HTTP Response Splitting source: https://www.securityfocus.com/bid/15301/info PHP Handicapper is vulnerable to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker...

IdealBB multiple flaws

The remote host is running IdealBB, a web based bulletin board written in ASP. The remote version of this software is vulnerable to multiple flaws: SQL injection, cross-site scripting and HTTP response splitting vulnerabilities. OpenVAS Vulnerability Test $Id: idealbbmultipleflaws.nasl 5786...

PHP Handicapper (2005) - 'Process_signup.php' HTTP Response Splitting

source: https://www.securityfocus.com/bid/15301/info PHP Handicapper is vulnerable to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresent...

IdealBB multiple flaws

The remote version of this IdealBB is vulnerable to multiple flaws: SQL injection, cross-site scripting and HTTP response splitting vulnerabilities. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

Snitz Forums 2000 HTTP Response Splitting

The remote host is using Snitz Forums 2000 - an ASP based forum/bbs. There is a bug in this software which makes it vulnerable to HTTP response splitting vulnerability. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are Copyright...

phpBB < 2.0.10

The remote host is running a version of phpBB older than 2.0.10. phpBB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input in the 'searchauthor' parameter. This version is also vulnerable to a HTTP respon...

phpBB < 2.0.10 Multiple Vulnerabilities

phpBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpbb:phpbb"; ifdescription...

DCP-Portal <= 5.3.2 Multiple Vulnerabilities - Active Check

DCP-Portal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2003 k-otik.com SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2004-2512

CVE-2004-2512 affects DCP-Portal 5.3.2 and earlier. It is a CRLF injection/vulnerability in calendar.php that enables HTTP response splitting via CRLF (%0d%0a) sequences in the PHPSESSID parameter, allowing spoofing of web content and potential cache poisoning. The provided documents confirm the ...

CVE-2004-2512

CRLF injection vulnerability in calendar.php in DCP-Portal 5.3.2 and earlier allows remote attackers to conduct HTTP response splitting attacks to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the PHPSESSID parameter...

[SNS Advisory No.84] Oracle Application Server HTTP Response Splitting Vulnerability

---------------------------------------------------------------------- SNS Advisory No.84 Oracle Application Server HTTP Response Splitting Vulnerability Problem first discovered on: Tue, 01 Feb 2005 Published on: Tue, 21 Oct 2005...

security flaw

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting...

CVE-2005-2703

CVE-2005-2703 affects Firefox up to 1.0.7 and Mozilla Suite up to 1.7.12. The issue lets a remote attacker modify HTTP headers of XML HTTP requests made via XMLHttpRequest, potentially enabling attacks such as HTTP request smuggling or splitting. This is triggered by how XMLHttpRequests are handl...

CVE-2005-2703

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting...

security flaw

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting...

ASP-Nuke &lt;= 0.80 language_select.aspHTTP响应拆分漏洞

BUGTRAQ: 14063 ASPNuke中存在HTTP响应拆分漏洞，成功利用这个漏洞的攻击者可以影响或误导保存、缓存或解释Web内容的方式。 起因是没有正确的过滤用户输入。请看/module/support/language/languageselect.asp第31行代码： ... If steForm action = go Then make sure the required fields are present If TrimsteForm LangCode = Then sErrorMsg = steGetText Please select a language fro...

FreeBSD : squid -- HTTP response splitting cache pollution attack (4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3)

According to a whitepaper published by Sanctum, Inc., it is possible to mount cache poisoning attacks against, among others, squid proxies by inserting false replies into the HTTP stream. The squid patches page notes : This patch additionally strengthens Squid from the HTTP response attack...

CVE-2004-2208

IdealBB (Ideal Science) web bulletin board versions 1.4.9–1.5.3 are affected by a CRLF injection vulnerability that enables HTTP response splitting. The CVE-2004-2208 entries across NVD, Red Hat, CVE listing, and OpenVAS describe this as a remote issue with unknown vectors, impacting integrity (I...