IBM Spectrum Protect和IBM Spectrum Protect Plus 注入漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An HTTP header injection vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. The vulnerability...

IBM Emptoris Sourcing Web Cache Poisoning Vulnerability

IBM Emptoris Sourcing helps organizations get affordable pricing and greater value from suppliers by examining factors such as cost, risk and performance in strategic sourcing decisions. A Web cache poisoning vulnerability exists in IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3. The...

CVE-2020-4896

IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987...

CVE-2020-4896

IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987...

Input validation

IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987...

CVE-2020-4896

IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987...

CVE-2020-4896

CVE-2020-4896 affects IBM Emptoris Sourcing versions 10.1.0.x, 10.1.1.x, and 10.1.3.x. The root cause is improper input validation that allows manipulating HTTP request headers to perform a web cache poisoning attack. Public references (NVD, CNVD, and IBM bulletin) confirm the vulnerability and a...

IBM Emptoris Sourcing 环境问题漏洞

IBM Emptoris Sourcing helps organizations get affordable pricing and greater value from suppliers by examining factors such as cost, risk and performance in strategic sourcing decisions. A Web cache poisoning vulnerability exists in IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3. The...

CVE-2020-5019

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the...

Security Bulletin: Web Cache Poisoning Vulnerability Affects IBM Emptoris Sourcing (CVE-2020-4896)

Summary Web cache poisoning vulnerability affects IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2020-4896 DESCRIPTION: IBM Emptoris is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. CVSS Base score: 6.5 CVSS Temporal Score: See:...

CVE-2020-4896

IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987...

Huawei EulerOS: Security Advisory for squid (EulerOS-SA-2020-2534)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi.CVE-2019-18860 - An issue...

CVE-2020-17470

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs they are always set to 1 in fnetdnspoll in fnetdns.c. This significantly simplifies DNS cache poisoning attacks...

CVE-2020-17470

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs they are always set to 1 in fnetdnspoll in fnetdns.c. This significantly simplifies DNS cache poisoning attacks...

CVE-2020-17439

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...

Default configuration

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...

Code injection

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs they are always set to 1 in fnetdnspoll in fnetdns.c. This significantly simplifies DNS cache poisoning attacks...

CVE-2020-17470

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs they are always set to 1 in fnetdnspoll in fnetdns.c. This significantly simplifies DNS cache poisoning attacks...

CVE-2020-17470

CVE-2020-17470 affects FNET (up to 4.6.4) where DNS client interface initialization leaves DNS transaction IDs non-random (always 1 in _fnet_dns_poll in fnet_dns.c), making DNS cache poisoning more feasible. The CVE is documented with a MEDIUM base score (~4.0–5.3 range in the CVSS vectors) and i...