Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2019-12387

python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

CVSS 3.1 · 6.1 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Fedoraproject Oracle and 2 more
Products
Ubuntu Linux Fedora Solaris and 5 more
CVE-2016-1000111

Twisted: sets environmental variable based on user supplied Proxy request header

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Redhat Twisted
Products
Enterprise Linux Satellite Satellite Capsule and 1 more