CWE-93 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-93/ Sun, 26 Feb 2023 09:05:39 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-93 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-93/ 32 32 CVE-2007-0892 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-0892/ Sun, 26 Feb 2023 09:05:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-0892/ CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with “FILE:”.

The post CVE-2007-0892 appeared first on CVE Vulnerability.

]]> CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with “FILE:”.

The post CVE-2007-0892 appeared first on CVE Vulnerability.

]]> CVE-2018-6148 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6148/ Sun, 26 Feb 2023 06:50:36 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6148/ Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

The post CVE-2018-6148 appeared first on CVE Vulnerability.

]]> Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

The post CVE-2018-6148 appeared first on CVE Vulnerability.

]]> CVE-2018-19585 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-19585/ Sun, 26 Feb 2023 06:48:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-19585/ GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.

The post CVE-2018-19585 appeared first on CVE Vulnerability.

]]> GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.

The post CVE-2018-19585 appeared first on CVE Vulnerability.

]]> CVE-2018-12477 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12477/ Sun, 26 Feb 2023 06:45:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12477/ A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.

The post CVE-2018-12477 appeared first on CVE Vulnerability.

]]> A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.

The post CVE-2018-12477 appeared first on CVE Vulnerability.

]]> CVE-2018-1000164 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1000164/ Sun, 26 Feb 2023 06:44:34 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1000164/ gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in “process_headers” function in “gunicorn/http/wsgi.py” that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

The post CVE-2018-1000164 appeared first on CVE Vulnerability.

]]> gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in “process_headers” function in “gunicorn/http/wsgi.py” that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

The post CVE-2018-1000164 appeared first on CVE Vulnerability.

]]> CVE-2020-11078 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-11078/ Sun, 26 Feb 2023 06:36:04 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-11078/ In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

The post CVE-2020-11078 appeared first on CVE Vulnerability.

]]> In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

The post CVE-2020-11078 appeared first on CVE Vulnerability.

]]> CVE-2019-9947 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-9947/ Sun, 26 Feb 2023 06:35:08 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-9947/ An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with rn (specifically in the path component of a URL that lacks a ? character) followed by an […]

The post CVE-2019-9947 appeared first on CVE Vulnerability.

]]> An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with rn (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

The post CVE-2019-9947 appeared first on CVE Vulnerability.

]]> CVE-2019-9741 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-9741/ Sun, 26 Feb 2023 06:35:04 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-9741/ An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with rn followed by an HTTP header or a Redis command.

The post CVE-2019-9741 appeared first on CVE Vulnerability.

]]> An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with rn followed by an HTTP header or a Redis command.

The post CVE-2019-9741 appeared first on CVE Vulnerability.

]]> CVE-2019-9740 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-9740/ Sun, 26 Feb 2023 06:35:04 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-9740/ An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with rn (specifically in the query string after a ? character) followed by an HTTP header or a […]

The post CVE-2019-9740 appeared first on CVE Vulnerability.

]]> An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with rn (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

The post CVE-2019-9740 appeared first on CVE Vulnerability.

]]> CVE-2019-7313 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-7313/ Sun, 26 Feb 2023 06:34:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-7313/ www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.

The post CVE-2019-7313 appeared first on CVE Vulnerability.

]]> www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.

The post CVE-2019-7313 appeared first on CVE Vulnerability.

]]>