CWE-113 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-113/ Sun, 26 Feb 2023 09:07:46 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-113 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-113/ 32 32 CVE-2007-5595 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-5595/ Sun, 26 Feb 2023 09:07:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-5595/ CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

The post CVE-2007-5595 appeared first on CVE Vulnerability.

]]> CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

The post CVE-2007-5595 appeared first on CVE Vulnerability.

]]> CVE-2018-7830 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7830/ Sun, 26 Feb 2023 06:51:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7830/ Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Response Splitting’) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for ~1 minute by sending a specially crafted HTTP request.

The post CVE-2018-7830 appeared first on CVE Vulnerability.

]]> Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Response Splitting’) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for ~1 minute by sending a specially crafted HTTP request.

The post CVE-2018-7830 appeared first on CVE Vulnerability.

]]> CVE-2018-3911 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3911/ Sun, 26 Feb 2023 06:49:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3911/ An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 – Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings’ remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can […]

The post CVE-2018-3911 appeared first on CVE Vulnerability.

]]> An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 – Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings’ remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can send an HTTP request to trigger this vulnerability.

The post CVE-2018-3911 appeared first on CVE Vulnerability.

]]> CVE-2018-18837 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-18837/ Sun, 26 Feb 2023 06:47:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-18837/ An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

The post CVE-2018-18837 appeared first on CVE Vulnerability.

]]> An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

The post CVE-2018-18837 appeared first on CVE Vulnerability.

]]> CVE-2018-16979 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-16979/ Sun, 26 Feb 2023 06:47:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-16979/ Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.

The post CVE-2018-16979 appeared first on CVE Vulnerability.

]]> Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.

The post CVE-2018-16979 appeared first on CVE Vulnerability.

]]> CVE-2018-16181 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-16181/ Sun, 26 Feb 2023 06:46:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-16181/ HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks that may result in an arbitrary script injection or setting an arbitrary cookie values via unspecified vectors.

The post CVE-2018-16181 appeared first on CVE Vulnerability.

]]> HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks that may result in an arbitrary script injection or setting an arbitrary cookie values via unspecified vectors.

The post CVE-2018-16181 appeared first on CVE Vulnerability.

]]> CVE-2018-12116 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12116/ Sun, 26 Feb 2023 06:45:32 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12116/ Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

The post CVE-2018-12116 appeared first on CVE Vulnerability.

]]> Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

The post CVE-2018-12116 appeared first on CVE Vulnerability.

]]> CVE-2018-11347 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-11347/ Sun, 26 Feb 2023 06:45:12 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-11347/ The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to perform other attacks such […]

The post CVE-2018-11347 appeared first on CVE Vulnerability.

]]> The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to perform other attacks such as user redirection to a malicious website, HTTP response splitting, or HTTP cache poisoning.

The post CVE-2018-11347 appeared first on CVE Vulnerability.

]]> CVE-2018-1067 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1067/ Sun, 26 Feb 2023 06:44:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1067/ In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

The post CVE-2018-1067 appeared first on CVE Vulnerability.

]]> In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

The post CVE-2018-1067 appeared first on CVE Vulnerability.

]]> CVE-2018-0689 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-0689/ Sun, 26 Feb 2023 06:44:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-0689/ HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions released prior to 2018 March 13, EP-10VA firmware versions released prior to 2017 September 4, EP-30VA firmware versions released prior to 2017 June 19, EP-707A firmware versions released prior to 2017 August 1, […]

The post CVE-2018-0689 appeared first on CVE Vulnerability.

]]> HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions released prior to 2018 March 13, EP-10VA firmware versions released prior to 2017 September 4, EP-30VA firmware versions released prior to 2017 June 19, EP-707A firmware versions released prior to 2017 August 1, EP-708A firmware versions released prior to 2017 August 7, EP-709A firmware versions released prior to 2017 June 12, EP-777A firmware versions released prior to 2017 August 1, EP-807AB/AW/AR firmware versions released prior to 2017 August 1, EP-808AB/AW/AR firmware versions released prior to 2017 August 7, EP-879AB/AW/AR firmware versions released prior to 2017 June 12, EP-907F firmware versions released prior to 2017 August 1, EP-977A3 firmware versions released prior to 2017 August 1, EP-978A3 firmware versions released prior to 2017 August 7, EP-979A3 firmware versions released prior to 2017 June 12, EP-M570T firmware versions released prior to 2017 September 6, EW-M5071FT firmware versions released prior to 2017 November 2, EW-M660FT firmware versions released prior to 2018 April 19, EW-M770T firmware versions released prior to 2017 September 6, PF-70 firmware versions released prior to 2018 April 20, PF-71 firmware versions released prior to 2017 July 18, PF-81 firmware versions released prior to 2017 September 14, PX-048A firmware versions released prior to 2017 July 4, PX-049A firmware versions released prior to 2017 September 11, PX-437A firmware versions released prior to 2017 July 24, PX-M350F firmware versions released prior to 2018 February 23, PX-M5040F firmware versions released prior to 2017 November 20, PX-M5041F firmware versions released prior to 2017 November 20, PX-M650A firmware versions released prior to 2017 October 17, PX-M650F firmware versions released prior to 2017 October 17, PX-M680F firmware versions released prior to 2017 June 29, PX-M7050F firmware versions released prior to 2017 October 13, PX-M7050FP firmware versions released prior to 2017 October 13, PX-M7050FX firmware versions released prior to 2017 November 7, PX-M7070FX firmware versions released prior to 2017 April 27, PX-M740F firmware versions released prior to 2017 December 4, PX-M741F firmware versions released prior to 2017 December 4, PX-M780F firmware versions released prior to 2017 June 29, PX-M781F firmware versions released prior to 2017 June 27, PX-M840F firmware versions released prior to 2017 November 16, PX-M840FX firmware versions released prior to 2017 December 8, PX-M860F firmware versions released prior to 2017 October 25, PX-S05B/W firmware versions released prior to 2018 March 9, PX-S350 firmware versions released prior to 2018 February 23, PX-S5040 firmware versions released prior to 2017 November 20, PX-S7050 firmware versions released prior to 2018 February 21, PX-S7050PS firmware versions released prior to 2018 February 21, PX-S7050X firmware versions released prior to 2017 November 7, PX-S7070X firmware versions released prior to 2017 April 27, PX-S740 firmware versions released prior to 2017 December 3, PX-S840 firmware versions released prior to 2017 November 16, PX-S840X firmware versions released prior to 2017 December 8, PX-S860 firmware versions released prior to 2017 December 7) may allow a remote attackers to lead a user to a phishing site or execute an arbitrary script on the user’s web browser.

The post CVE-2018-0689 appeared first on CVE Vulnerability.

]]>