CWE-74 Archives - CVE Vulnerability

CVE-2008-0456

Sun, 26 Feb 2023 09:08:33 +0000

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) “406 Not Acceptable” or (2) “300 Multiple Choices” HTTP response when the extension is omitted in a request for the file.

The post CVE-2008-0456 appeared first on CVE Vulnerability.

CVE-2007-4190

Sun, 26 Feb 2023 09:07:06 +0000

CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting (XSS) attacks. NOTE: some of these details are obtained from third party information.

The post CVE-2007-4190 appeared first on CVE Vulnerability.

CVE-2018-9062

Sun, 26 Feb 2023 06:51:43 +0000

In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.

The post CVE-2018-9062 appeared first on CVE Vulnerability.

CVE-2018-7032

Sun, 26 Feb 2023 06:50:54 +0000

webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a MitM attacker to take advantage of it for arbitrary code execution, as demonstrated by an “ext::sh -c” attack or an option injection attack.

The post CVE-2018-7032 appeared first on CVE Vulnerability.

CVE-2018-6603

Sun, 26 Feb 2023 06:50:47 +0000

Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie.

The post CVE-2018-6603 appeared first on CVE Vulnerability.

CVE-2018-6519

Sun, 26 Feb 2023 06:50:45 +0000

The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp.

The post CVE-2018-6519 appeared first on CVE Vulnerability.

CVE-2018-6289

Sun, 26 Feb 2023 06:50:39 +0000

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.

The post CVE-2018-6289 appeared first on CVE Vulnerability.

CVE-2018-6220

Sun, 26 Feb 2023 06:50:38 +0000

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems.

The post CVE-2018-6220 appeared first on CVE Vulnerability.

CVE-2018-4995

Sun, 26 Feb 2023 06:50:09 +0000

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an XFA ‘n’ POST injection vulnerability. Successful exploitation could lead to a security bypass.

The post CVE-2018-4995 appeared first on CVE Vulnerability.

CVE-2018-4235

Sun, 26 Feb 2023 06:49:59 +0000

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the “Messages” component. It allows local users to perform impersonation attacks via an unspecified injection.

The post CVE-2018-4235 appeared first on CVE Vulnerability.