CVE-2017-1552

CVE-2017-1552 affects IBM InfoSphere BigInsights 4.2.0 and 4.2.5. The IBM bulletin confirms a link-injection vulnerability in the web UI that could be exploited by a user clicking a specially crafted URL to induce cross-site scripting, cache poisoning, or session hijacking. Affected products/vers...

tomcat: Vary header not added by CORS filter leading to cache poisoning

A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches...

tomcat security update

0:7.0.76-3 - Resolves: rhbz1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws - Resolves: rhbz1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning - Resolves: rhbz1470596 CVE-2017-5647 Add follow up revision...

RHEL 7 : tomcat (RHSA-2017:3081)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3081 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: A vulnerability was...

Inflection: Host Header Injection or cache poisoning in multiple domains

Researcher submitted a report related to host header injection, which is currently considered out of scope for our program, so we closed the report. Researcher requested public disclosure...

Google Go Denial of Service Vulnerability (CNVD-2017-32897)

Google Go is a programming language optimized for programming applications on multiprocessor systems by Google. A security vulnerability exists in the net/http inventory of the net/http/transfer.go file in versions of Google Go prior to 1.4.3, which stems from the program's failure to properly...

IBM WebSphere Application Server HTTP Response Splitting Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An HTTP response splitting vulnerability exists in IBM WAS. ...

CVE-2017-1503

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

CVE-2017-1503

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

Cross site scripting

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

CVE-2017-1503

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2017-903)

1480618 : Vary header not added by CORS filter leading to cache poisoning The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. CVE-2017-7674 C Tenable...

Medium: tomcat7, tomcat8

Issue Overview: 1480618: Vary header not added by CORS filter leading to cache poisoning The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

BSA-2017-432

Security Advisory ID : BSA-2017-432 Component : JOBSS Revision : 2.0: Interim Red HatJBossEAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact. Affected Products Brocade is investigating...

MGASA-2017-0352 Updated tomcat packages fix security vulnerability

The CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances CVE-2017-7674. When using a VirtualDirContext it was possible to bypass security constraints and/or view the source...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via unknown vectors...

CVE-2014-6106

Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via unknown vectors...

Debian DSA-3974-1 : tomcat8 - security update

Two issues were discovered in the Tomcat servlet and JSP engine. - CVE-2017-7674 Rick Riemer discovered that the Cross-Origin Resource Sharing filter did not add a Vary header indicating possible different responses, which could lead to cache poisoning. - CVE-2017-7675 stretch only Markus...

[SECURITY] [DSA 3974-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3974-1 [email protected] https://www.debian.org/security/ Sebastien Delafond September 15, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3974-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3974-1 [email protected] https://www.debian.org/security/ Sebastien Delafond September 15, 2017 https://www.debian.org/security/faq -...