SUSE-SU-2020:1511-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Java was updated to jdk-11.0.7+10 April 2020 CPU, bsc1169511. Security issues fixed: - CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service bsc1169511. - CVE-2020-2755: Fixed an...

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...

ceph14 -- HTTP header injection via CORS ExposeHeader tag

Red Hat bugzilla reports: A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection ...

ruby: HTTP response splitting in WEBrick

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...

DEBIAN-CVE-2020-1695

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to...

UBUNTU-CVE-2020-1695

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to...

HTTP Host Header Injection

A host header injection is inserting both the carriage return and linefeed characters into user input to trick the server. Successful exploitation could allow attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks...

Cisco Umbrella Injection Vulnerability

Cisco Umbrella is a suite of cloud security platforms from Cisco. The platform prevents cyber threats such as phishing, malware and ransomware. Cisco Umbrella suffers from an injection vulnerability that stems from the program not adequately validating user-submitted input. An attacker could...

CoSoSys Endpoint Protector Injection Vulnerability

CoSoSys Endpoint Protector is a cross-platform data loss prevention system from CoSoSys Romania. The system supports USB and peripheral port control, dynamic data scanning, USB encryption and static data scanning. An injection vulnerability exists in CoSoSys Endpoint Protector version 5.1.0.2,...

CVE-2019-13285

CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection...

CVE-2019-13285

CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection...

Design/Logic Flaw

CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection...

CVE-2019-13285

CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection...

CVE-2019-13285

CVE-2019-13285 affects CoSoSys Endpoint Protector 5.1.0.2, as shown by multiple connected records. The vulnerability is described as a Host Header Injection in Endpoint Protector; the available sources do not provide detailed exploitation vectors or affected components beyond the general product/...

CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

Design/Logic Flaw

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

CVE-2019-12425

CVE-2019-12425 affects Apache OFBiz 17.12.01 and is described as a Host header injection vulnerability caused by accepting arbitrary Host headers. This is documented across multiple sources (e.g., NVD entry and Red Hat, CNVD, OSV, CVE lists) with the consistent description that OFBiz 17.12.01 is ...

ruby: HTTP response splitting in WEBrick

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client...