Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to Host Header Injection (CVE-2021-39028)

Summary IBM Engineering Lifecycle Optimization - Publishing is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. CVE-2021-39028. Vulnerability Details CVEID:CVE-2021-39028 DESCRIPTION: IBM Engineering Lifecycle Optimization - Publishing is vulnerable...

CVE-2021-39028

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site...

Known vulnerable to account takeover via host header injection attack in v1.3.1

Known v1.3.1 was discovered to allow attackers to perform an account takeover via a host header injection attack. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x...

GHSA-P757-4V3P-J74F Known vulnerable to account takeover via host header injection attack in v1.3.1

Known v1.3.1 was discovered to allow attackers to perform an account takeover via a host header injection attack. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x...

CVE-2022-34914

Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The clientIp variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated by a client to store an arbitrary valu...

Design/Logic Flaw

Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The clientIp variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated by a client to store an arbitrary valu...

CVE-2022-34914

Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The clientIp variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated by a client to store an arbitrary valu...

CVE-2022-34914

CVE-2022-34914 affects Webswing prior to 22.1.3. The issue arises from X-Forwarded-For header injection into the clientIp configuration variable, allowing a client to substitute startup arguments by manipulating the header, and injecting multiple arguments into the session startup. Systems that d...

CVE-2022-34306

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. I...

CVE-2022-34306

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. I...

Cross site scripting

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. I...

CVE-2022-34306

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. I...

CVE-2022-33011

Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33011

Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack...

Design/Logic Flaw

Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33011

Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33011

Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33011

CVE-2022-33011 affects Known (open-source social publishing platform). Multiple connected sources corroborate an account takeover via host header injection in v1.3.1 and earlier. Red Hat, Veracode and OSV entries describe the root cause as lack of validation in the password reset flow, notably in...

CVE-2022-33011: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack...

PT-2022-21644

Name of the Vulnerable Software and Affected Versions Known versions 1.3.1 and prior Description The issue allows attackers to perform an account takeover via a host header injection attack. Recommendations For versions 1.3.1 and prior, consider restricting access to sensitive account information...