Spiceworks 7.5 - HTTP Header Injection

Exploit Title: Spiceworks 7.5 - HTTP Header Injection Google Dork: inurl:/prousers/login Discovered Date: 15/09/2020 Exploit Author: Ramikan Vendor Homepage: https://www.spiceworks.com Affected Version: 7.5.7.0 may be others. Tested On Version: 7.5.7.0 CVE : CVE-2020-25901 Vulnerability: Host...

Spiceworks 7.5 HTTP Header Injection

Exploit Title: Spiceworks 7.5 - HTTP Header Injection Google Dork: inurl:/prousers/login Discovered Date: 15/09/2020 Exploit Author: Ramikan Vendor Homepage: https://www.spiceworks.com Affected Version: 7.5.7.0 may be others. Tested On Version: 7.5.7.0 CVE : CVE-2020-25901 Vulnerability: Host...

CVE-2020-3561: Improper Neutralization of CRLF Sequences

A vulnerability in the Clientless SSL VPN WebVPN of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to...

Security Bulletin: IBM Security Guardium is affected by Python vulnerabilities

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-9948 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a specially-crafted request, an...

PT-2020-8940

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.0.0 Description The issue allows a remote attacker to inject arbitrary HTTP headers in the http management interface, potentially leading to exploitation. Recommendations For Brocade Fabric OS versions pri...

CVE-2020-3117 Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...

CVE-2020-3117: Improper Neutralization of CRLF Sequences in HTTP Headers

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...

Ubuntu: Security Advisory (USN-4528-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4528-1 ceph vulnerabilities

Adam Mohammed discovered that Ceph incorrectly handled certain CORS ExposeHeader tags. A remote attacker could possibly use this issue to preform an HTTP header injection attack. CVE-2020-10753 Lei Cao discovered that Ceph incorrectly handled certain POST requests with invalid tagging XML. A remo...

Security Bulletin: Vulnerabilities in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager (CVE-2019-18348)

Summary Vulnerabilities in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager CVE-2019-18348 Vulnerability Details CVEID: CVE-2019-18348 DESCRIPTION: Python is vulnerable to HTTP header injection, caused by improper validation of input in the urllib2. By sending a...

Security Bulletin: [All] Python (Publicly disclosed vulnerability)

Summary Vulnerabilities in Open Source Python affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2019-9948 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Ratpack

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Ratpack. Vulnerability Details CVEID: CVE-2019-11808 DESCRIPTION: Ratpack could allow a remote attacker to obtain sensitive information, caused by the use of a weak PRNG to generate session ID in JDK's...

FreeBSD : Python -- multiple vulnerabilities (3fcb70a4-e22d-11ea-98b2-080027846a02)

Python reports : bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded CVE-2020-15523. bpo-41004: CVE-2020-14422: The hash methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.3 security and bug fix update

Updated packages that fixes one security issue and multiple bugs are now available for Red Hat Ceph Storage 3.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security update

An update is now available for Red Hat Ceph Storage 3.3 on Ubuntu 16.04. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

FreeBSD : Python -- multiple vulnerabilities (7d7221ee-d334-11ea-bc50-080027846a02)

Python reports : bpo-41304: Fixes python3x.pth being ignored on Windows, caused by the fix for bpo-29778 CVE-2020-15801. bpo-39603: Prevent http header injection by rejecting control characters in http.client.putreques. C Tenable Network Security, Inc. The descriptive text and package checks in...

HTTP Header Injection

ceph is vulnerable to HTTP header injection. The vulnerability exists in radosgw through the CORS ExposeHeader tag...

ceph: radosgw: HTTP header injection via CORS ExposeHeader tag

A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the...

openSUSE Security Update : ceph (openSUSE-2020-898)

This update for ceph fixes the following issues : - CVE-2020-10753: Fixed an HTTP header injection via CORS ExposeHeader tag bsc1171921. This update was imported from the SUSE:SLE-15-SP1:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

RHEL 7 / 8 : Red Hat Ceph Storage 4.1 (RHSA-2020:3003)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3003 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage...