Security Bulletin: Multiple vulnerabilities in current releases of IBM® SDK for Node.js™ in IBM Bluemix (CVE-2015-3197, CVE-2016-2086, CVE-2016-2216)

Summary This bulletin describes CVE-2015-3197 that was reported on January 26, 2015 by the OpenSSL Project, plus two additional vulnerabilities. Vulnerability Details CVEID: CVE-2015-3197 DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by the use of...

Security Bulletin: Multiple vulnerabilities in current releases of IBM® SDK for Node.js™

Summary This bulletin describes CVE-2015-3197 that was reported on January 26, 2015 by the OpenSSL Project, plus two additional vulnerabilities. Vulnerability Details CVEID: CVE-2015-3197 DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by the use of...

Security Bulletin: Multiple vulnerabilities in the IBM SDK for Node.js affect the Cordova tools in Rational Application Developer affecting Rational Developer for i and Rational Developer for AIX and Linux (CVE-2016-2086, CVE-2016-2216, CVE-2015-3197)

Summary Portions of IBM Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i RPG and COBOL + Modernization Tools, Java and EGL editions, and Rational Developer for AIX and Linux. Security vulnerabilities have been discovered in the IBM SDK f...

Samsung SmartThings Hub video-core REST Request Parser HTTP Pipelining Injection Vulnerabilities(CVE-2018-3907 - CVE-2018-3909)

Summary Multiple exploitable vulnerabilities exist in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. An...

Samsung SmartThings Hub video-core Database find-by-cameraId Code Execution Vulnerability(CVE-2018-3880)

Summary Multiple exploitable vulnerabilities exist in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. An...

CVE-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

DEBIAN-CVE-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

Design/Logic Flaw

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

CVE-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

CVE-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

CVE-2017-12165

Undertow vulnerability CVE-2017-12165 affects Undertow prior to 1.4.17, 1.3.31 and 2.0.0 where HTTP request header processing mishandles unusual whitespace, enabling possible HTTP request smuggling. Root cause: improper parsing of request headers. Impact details are described in the CVE, with hig...

CVE-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

CVE-2017-12165: Inconsistent Interpretation of HTTP Requests

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

CVE-2017-7658: Inconsistent Interpretation of HTTP Requests

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x all non HTTP/1.x configurations, and 9.4.x all HTTP/1.x configurations, when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Enterprise Service Bus (CVE-2015-1283, CVE-2015-3183)

Summary WebSphere Application Server is shipped as a component of WebSphere Enterprise Service Bus. Information about the security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Please consult the security bulletins Denial ...

Security Bulletin: A vulnerability in Open Source Apache Tomcat affects the IBM FlashSystem V840, (CVE-2014-0227)

Summary There is a vulnerability in Open Source Apache Tomcat that is used by the IBM FlashSystem V840 which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service under error scenarios. Vulnerability Details CVE-ID: CVE-2014-0227 Description: Apache Tomcat...

Security Bulletin: Vulnerabilities in the Apache HTTP Server affect PowerKVM (CVE-2015-3183,CVE-2015-3185)

Summary PowerKVM is affected by vulnerabilities in the Apache HTTP Server httpd. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2015-3183 DESCRIPTION: Apache HTTP Server is vulnerable to HTTP request smuggling, caused by a chunk header parsing flaw in the aprbrigadeflatten...

Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple vulnerabilities from Apache HTTP server (CVE-2015-1283, CVE-2015-3183)

Summary Multiple security vulnerabilities have been discovered in the Apache HTTP server that is embedded in the IBM FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2015-1283 DESCRIPTION: Multiple integer overflows in the XMLGetBuffer function in Expat through...

Security Bulletin: A vulnerability in Open Source Apache Tomcat affects the IBM FlashSystem 900, (CVE-2014-0227)

Summary There is a vulnerability in Open Source Apache Tomcat that is used by the IBM FlashSystem 900 which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service under error scenarios. Vulnerability Details CVE-ID: CVE-2014-0227 Description: Apache Tomcat ...

Security Bulletin: Apache Tomcat vulnerability affects IBM SONAS (CVE-2014-0227)

Summary A fix is available for IBM SONAS , Apache Tomcat unauthorized access vulnerability Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2014-0227...