Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Tivoli Business Service Manager, is vulnerable to HTTP header injection (CVE-2022-34165)

Summary IBM WebSphere Application Server is bundled as a component of the Tivoli Business Service Manager dashboard. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulleti...

Security Bulletin: Vulnerability in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty affects IBM Operations Analytics - Log Analysis (CVE-2022-34165)

Summary IBM WebSphere Application Server is vulnerable to HTTP header injection when processing web requests. This has been addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty...

AZL-35235 CVE-2022-35256 affecting package rust for versions less than 1.75.0-1

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty may affect IBM Spectrum Scale

Summary Multiple vulnerabilities in IBM WebSphere Application Server Liberty, used by IBM Spectrum Scale, which could allow identity spoofing by an authenticated user and cross-site scripting. Fix is available. Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Serv...

Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection

The plugins do not escape the userid POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database. POST /wp-admin/admin-ajax.php HTTP/1.1 Host:...

CVE-2021-38997 IBM API Connect HOST header injection

IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system,...

CVE-2021-38997 IBM API Connect HOST header injection

IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system,...

CVE-2021-38997

IBM API Connect is affected by CVE-2021-38997 through multiple version ranges: 10.0.0.0–10.0.5.0, 10.0.1.0–10.0.1.7, and 2018.4.1.0–2018.4.1.19. The root cause is improper validation of input in the HOST header, leading to HTTP header injection. Reported impacts include cross-site scripting, cach...

PT-2022-10836 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 10.0.0.0 through 10.0.5.0 IBM API Connect versions 10.0.1.0 through 10.0.1.7 IBM API Connect versions 2018.4.1.0 through 2018.4.1.19 Description: The issue is caused by improper validation of input by the HOST headers...

CVE-2021-33621

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3...

Security Bulletin: IBM Sterling Control Center is vulnerable to HTTP header injection due to Websphere Liberty (CVE-2022-34165)

Summary IBM Sterling Control Center uses IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty is vulnerable to HTTP header injection, caused by improper validation. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere...

rubygem-cgi -- HTTP response splitting vulnerability

Hiroshi Tokumaru reports: If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body. Also, the contents for a CGI::Cookie object were not checked properly. If an application create...

All In One WP Security & Firewall < 5.0.8 - IP Spoofing

The plugin is susceptible to IP Spoofing attacks, which can lead to bypassed security features like IP blocks, rate limiting, brute force protection, and more. Set HTTPXREALIP or HTTPXFORWARDEDFOR used in getuseripaddress to bypass IP-based blocks...

PT-2022-25493 · WordPress · Iridium Intelligence Bad Ip Wp Plugin

Name of the Vulnerable Software and Affected Versions: Iridium Intelligence bad ip WP Plugin affected versions not specified Description: A vulnerability was found in the HTTP Header Handler component of the Iridium Intelligence bad ip WP Plugin. The manipulation of the X-Forwarded-For argument...

PT-2022-25528 · Unknown · Yellow Tree Geolocation Ip Detection Plugin

Name of the Vulnerable Software and Affected Versions: Yellow Tree Geolocation IP Detection Plugin affected versions not specified Description: A vulnerability was found in the Yellow Tree Geolocation IP Detection Plugin, classified as problematic. It affects an unknown function of the component...

PT-2022-25520 · Codeboxr · Codeboxr Cbx User Online & Last Login Plugin

Name of the Vulnerable Software and Affected Versions: codeboxr CBX User Online & Last Login Plugin affected versions not specified Description: A vulnerability was found in the codeboxr CBX User Online & Last Login Plugin, affecting the HTTP Header Handler component. The manipulation of the...

PT-2022-25549 · WordPress · Getseofix Show Visitor Ip Address Widget/Shortcode Plugin

Name of the Vulnerable Software and Affected Versions: getseofix Show Visitor IP Address Widget and Shortcode Plugin affected versions not specified Description: A problematic vulnerability was found in the HTTP Header Handler component. The manipulation of the X-Forwarded-For argument leads to...

HTTP response splitting in CGI

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to...

GHSA-VC47-6RQG-C7F5 HTTP response splitting in CGI

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to...