CVE-2014-1956

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.fortiguard.com/advisory/FG-IR-13-009/Vendor Advisory
http://www.fortiguard.com/advisory/FG-IR-13-009/Vendor Advisory

Timeline

Published: Apr 30, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-19576.5FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.CVE-2014-19588.8Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitr CVE-2014-19595.8lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remo CVE-2014-19605.0The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via u CVE-2014-19615.0Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown CVE-2014-19625.0Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Ent CVE-2014-19635.0Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack ve CVE-2014-19644.3Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver CVE-2014-19654.3Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component CVE-2014-19667.8The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows re CVE-2014-19675.8The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacke CVE-2014-19684.3Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web sc