Security Bulletin: IBM Cognos Controller is affected by HTTP response splitting attack in WebSphere Application Server (CVE-2015-2017)

Summary There is a vulnerability in IBM WebSphere Application Server that could allow an HTTP response splitting attack in Channel. Vulnerability Details CVEID: CVE-2015-2017 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker could...

Security Bulletin: Multiple vulnerabilities in Drupal Core affect IBM API Management (CVE-2016-9449, CVE-2016-9450, CVE-2016-9451, CVE-2016-9452)

Summary Drupal is used by the Advanced Developer Portal in IBM API Management. IBM API Management has updated the level of Drupal it provides to address the applicable CVEs. Vulnerability Details CVEID: CVE-2016-9449 DESCRIPTION: Drupal Core could allow a remote authenticated attacker to obtain...

Security Bulletin: HTTP response splitting attack in IBM WebSphere Appliance Management Center (CVE-2015-2017)

Summary There is a vulnerability in IBM WebSphere Appliance Management Center that could allow an HTTP response splitting attack in Channel. Vulnerability Details CVEID: CVE-2015-2017 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker...

D-Link DIR-815 Cross-Site Request Forgery Vulnerability

D-Link DIR-815 is a wireless router product from AUO D-Link. A cross-site request forgery vulnerability exists in the D-Link DIR-815 with firmware prior to version 2.07.B01, which stems from the program failing to properly validate user-submitted input. A remote attacker could exploit this...

Cache poisoning and other dirty tricks

by @bo0om, Wallarm Research Caching is a great technology practice. It makes life better for everybody — clients get the data faster, servers expend fewer resources and so on. There is even a whole CDN industry that was built to deliver caching as a service. There are many examples of caching...

Greenhouse.io: Bypass of request line length limit to DoS via cache poisoning

Summary This is a bypass of the fix that was introduced in response to report 334709. The bug in question was that it was possible to poison the cache of the generated JS file at https://boards.greenhouse.io/embed/jobboard/js?for=surveymonkey, by appending a URL-encoded NULL byte %00, followed by...

Dell EMC RSA Authentication Manager Security Console, Operation Console and Self-Service Console Host Header Injection Vulnerability

Dell EMC RSA Authentication Manager is a centralized set of binary authentication software from Dell Dell. The software allows for centralized management of binary authentication, security tokens, methods, and users across physical sites.RSA Authentication Manager Security Console is one of the...

CVE-2018-1248

RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulnerability. This could allow a remote attacker to potentially poison HTTP cache and subsequently redirect users to arbitrary web domains...

CVE-2018-1248

RSA Authentication Manager (Security Console, Operation Console and Self-Service Console) v8.3 and earlier is affected by a Host header injection vulnerability that can poison HTTP caches and redirect users to arbitrary web domains. Root cause: improper handling of HTTP headers in the consoles. I...

undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)

It was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the...

Greenhouse.io: Cache poisoning using NULL bytes and long URLs

This is related to a previous report I made https://hackerone.com/reports/326639. The same endpoint https://boards.greenhouse.io/embed/jobboard/js?for= is still vulnerable to arbitrary string injection, by terminating the customer key in the for parameter with a URL-encoded NULL byte i.e. %00,...

Squid < 3.5.18 Host Header Handling Same-Origin Protection / Content Filtering Bypass (SQUID-2016:8)

According to its banner, the version of Squid running on the remote host is prior to 3.5.18. It is, therefore, potentially affected by a Host header same-origin filtering bypass vulnerability. A remote attacker could exploit this issue to poison the cache by forcing a Host header value past...

Greenhouse.io: DoS through cache poisoning using invalid HTTP parameters

I was taking a look into a related report https://hackerone.com/reports/298265 and I discovered that the https://boards.greenhouse.io/embed/jobboard/js?for= endpoint doesn't throw errors when I try to pass in an array of for parameters like this:...

RHEL 7 : JBoss Enterprise Application Platform 7.1.1 for RHEL 7 (Important) (RHSA-2018:0480)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0480 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

HPESBUX03828 rev.2 - HP-UX Tomcat-based Servlet Engine, Remote Cache Poisoning or Security Constraint Bypass

Potential Security Impact: Remote: Bypass Security Restrictions, Disclosure of Information, Multiple Vulnerabilities, Unauthenticated Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX Tomcat-based Servlet v.7.x Engine D.7.0.77.01 and earlier CVSS...

IBM TRIRIGA Application Platform Cross-Site Request Forgery Vulnerability

The IBM TRIRIGA Application Platform is a set of technology platforms for deploying TRIRIGA applications from IBM in the United States. The platform provides a set of design-time and run-time components for building and running its enterprise applications, respectively, and supports...