- Drupal Core is prone to a HTTP response splitting vulnerability because it fails to properly verify user-supplied input. An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Drupal Core versions 4.7.x ranging from 4.7.0 and up to and including 4.7.7 are vulnerable.
- Update to Drupal Core version 4.7.8 or latest
- WordPress Plugin NextGEN Gallery-WordPress Gallery Security Bypass (3.1.6)
- WordPress Plugin WPtouch Mobile Arbitrary File Upload (3.4.6)
- WordPress Plugin WP Background Takeover Directory Traversal (4.1.4)
- WordPress Plugin EZ Google Analytics Cross-Site Scripting (4.1.06)
- WordPress Plugin Conversador Cross-Site Scripting (2.61)