https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:23:13 +0000 https://cve.radiocsirt.org/vuln/certfr-2014-avi-480 certfr-2014-avi-480 https://cve.radiocsirt.org/vuln/certfr-2014-avi-480 https://cve.radiocsirt.org/vuln/euvd-2026-114707 EUVD-2026-114707 https://cve.radiocsirt.org/vuln/euvd-2026-114707 https://cve.radiocsirt.org/vuln/fkie_cve-2011-1398 <p>The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.</p> <p>The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2011-1398 https://cve.radiocsirt.org/vuln/ghsa-g6fq-45x6-cmh4 <p>The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.</p> <p>The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.</p> https://cve.radiocsirt.org/vuln/ghsa-g6fq-45x6-cmh4 https://cve.radiocsirt.org/vuln/gsd-2011-1398 gsd-2011-1398 https://cve.radiocsirt.org/vuln/gsd-2011-1398 https://cve.radiocsirt.org/vuln/rhsa-2013:0514 <p>PHP: sapi_header_op() %0D sequence handling security bypass php: PG(magic_quote_gpc) was not restored on shutdown php: Integer Signedness issues in _php_stream_scandir</p> <p>PHP: sapi_header_op() %0D sequence handling security bypass php: PG(magic_quote_gpc) was not restored on shutdown php: Integer Signedness issues in _php_stream_scandir</p> https://cve.radiocsirt.org/vuln/rhsa-2013:0514