CVE-2009-4086

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Nov 29, 2009
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2009

CVE-2009-40874.3Cross-site scripting (XSS) vulnerability in index.php in telepark.wiki 2.4.23 and earlier allows remote attackers to inject arbitrary web scCVE-2009-40886.8Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via directorCVE-2009-40895.0telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a modified pageID parameCVE-2009-40907.5Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to execute CVE-2009-40915.0comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete coCVE-2009-40926.8Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the CVE-2009-40934.3Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remote attackers to injeCVE-2009-40947.5PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remoCVE-2009-40957.5myPhile 1.2.1 allows remote attackers to bypass authentication via an empty password. NOTE: some of these details are obtained from third pCVE-2009-40967.5RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to oCVE-2009-40979.3Stack-based buffer overflow in the MplayInputFile function in Serenity Audio Player 3.2.3 and earlier allows remote attackers to execute arbCVE-2009-40986.0Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner
CVE-2009-4086: Medium severity, CVSS 5.0 | Vulnix