6174 matches found
CVE-2022-43562 Host Header Injection in Splunk Enterprise
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and cache poisoning...
CVE-2022-43562 Host Header Injection in Splunk Enterprise
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and cache poisoning...
Cisco Secure Email and Web Manager (SMA) HTTP Response Header Injection (cisco-sa-ESA-HTTP-Inject-nvsycUmR)
According to its self-reported version, Cisco Secure Email and Web Manager SMA is affected by a vulnerability due to a failure to sanitize input values. An unauthenticated, remote attacker can exploit this, by injecting malicious HTTP headers, in order to conduct an HTTP response splitting attack...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Business Automation Workflow (CVE-2022-34165)
Summary WebSphere Application Server Liberty is shipped as part of IBM Business Automation Workflow containers and as part of the optional components Process Federation Server since 8.5.6, and User Management Service since 18.0.0.1 in IBM Business Automation Workflow traditional. Information abou...
CVE-2022-39369
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
Twisted vulnerable to NameVirtualHost Host header injection
...
Security Bulletin: CP4D Match 360 is vulnerable to HTTP header injection within IBM WebSphere Application Server Liberty (CVE-2022-34165)
Summary CP4D Match 360 is vulnerable to HTTP header injection within IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various...
Twisted vulnerable to NameVirtualHost Host header injection
When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. Example configuration: python from twisted.web.server import Site from...
GHSA-VG46-2RRJ-3647 Twisted vulnerable to NameVirtualHost Host header injection
When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. Example configuration: python from twisted.web.server import Site from...
CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...
Security Bulletin: IBM Robotic Process Automation may be vulnerable to HTTP Header Injections due to IBM WebSphere Application Server Liberty (CVE-2022-34165)
Summary IBM WebSphere Applicaiton Server Liberty is used by IBM Robotic Process Automation as part of OCR, Antivirus, and User Management Services. CVE-2022-34165 Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere...
OPENSUSE-SU-2022:10148-1 Security update for roundcubemail
This update for roundcubemail fixes the following issues: roundcubemail was updated to 1.5.3 Enigma: Fix initial synchronization of private keys Enigma: Fix double quoted-printable encoding of pgp-signed messages with no attachments 8413 Fix various PHP8 warnings 8392 Fix mail headers injection v...
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Directory Server
Summary IBM WebSphere Application Server is shipped with IBM Security Directory Server. Information about security vulnerabilities affecting IBM WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
phpIPAM header injection vulnerability
phpIPAM is an open source PHP and MySQL-based IP address management application IPAM. phpIPAM version 1.5.0 is vulnerable to header injection, which stems from a lack of validation of input data in component/admin/subnets/ripe-query.php, and can be exploited by attackers to cause header injection...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Business Monitor (CVE-2022-34165)
Summary IBM WebSphere Application Server is shipped as a component of Business Monitor. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application...
Security Bulletin: Liberty for Java for IBM Cloud is vulnerable to HTTP header injection (CVE-2022-34165)
Summary Liberty for Java for IBM Cloud is vulnerable to HTTP header injection when processing web requests. This has been addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0....
GHSA-398J-F7M7-795J PHPMailer vulnerable to email header injection
Impact Arbitrary additional email headers can be injected via crafted From or Sender headers. Patches Fixed in 2.2.1 Workarounds Filter user-supplied values prior to using them in From or Sender properties. References https://nvd.nist.gov/vuln/detail/CVE-2012-0796 For more information If you have...
PHPMailer vulnerable to email header injection
Impact Arbitrary additional email headers can be injected via crafted From or Sender headers. Patches Fixed in 2.2.1 Workarounds Filter user-supplied values prior to using them in From or Sender properties. References https://nvd.nist.gov/vuln/detail/CVE-2012-0796 For more information If you have...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2022-34165)
Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
