4199 matches found
RHCOS 4 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory. - kube-apiserver: Aggregated API server can cause clients to be redirected SSRF CVE-2022-3172 - spring-security-oauth2-client:...
[SECURITY] [DLA 3716-1] ruby-httparty security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3716-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb January 23, 2024 https://wiki.debian.org/LTS -...
Security Bulletin: IBM Tivoli Application Dependency Discovery Manager affected by multiple vulnerabilities.
Summary IBM Tivoli Application Dependency Discovery Manager is vulnerable to denial of service due to multiple vulnerabilities. Vulnerability Details CVEID:CVE-2023-47143 DESCRIPTION: IBM Tivoli Application Dependency Discovery Manager is vulnerable to HTTP header injection, caused by improper...
SUSE-SU-2024:0168-1 Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: Updated to version 3.8.6: - CVE-2023-49082: Fixed an HTTP header injection via a crafted method bsc1217682...
CVE-2023-50963
IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...
Cross site scripting
IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...
CVE-2023-50963 IBM Storage Defender HTTP HOST header injection
IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...
CVE-2023-50963
IBM Storage Defender – Data Protect versions 1.0.0–1.4.1 are vulnerable to HTTP header injection due to improper validation of HOST headers, enabling attacks such as cross-site scripting, cache poisoning, or session hijacking as described in IBM X-Force/Red Hat advisories. Remediation: IBM recomm...
CVE-2023-50963 IBM Storage Defender HTTP HOST header injection
IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...
CVE-2023-50963: URL Redirection to Untrusted Site
IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...
WordPress Backup Migration 1.3.7 Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Backup Migration Plugin PHP Filter Chain RCE', 'Description' = %q This module exploits an unauth RCE in the WordPress plugin: Backup...
PT-2024-14033 · Ibm · Ibm Storage Defender - Data Protect
Name of the Vulnerable Software and Affected Versions: IBM Storage Defender - Data Protect versions 1.0.0 through 1.4.1 Description: The issue is caused by improper validation of input by the HOST headers, leading to HTTP header injection. This could allow an attacker to conduct various attacks...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2023.
Summary Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF028 and 23.0.1-IF006. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By...
WordPress Manutenção < 1.0.7 - IP Spoofing to Maintenance Mode Bypass
Description The plugin is vulnerable to IP Spoofing due to insufficient validation of IP addresses, allowing unauthenticated attackers to bypass the plugin's maintenance mode restriction via the 'X-Forwarded-For' HTTP header...
EulerOS 2.0 SP9 : python-pip (EulerOS-SA-2023-3315)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for...
CVE-2023-52274
member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header...
CVE-2023-52274
CVE-2023-52274 affects YzmCMS versions 6.5–7.0, where a cross-site scripting (XSS) vulnerability exists in member/index/register.html via the Referer HTTP header. The CNVD/NVD/OSV/CVE entries describe the root cause as insufficient filtering/escaping of user-supplied data in the Referer header, e...
CVE-2023-52274: Improper Neutralization of Input During Web Page Generation
member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header...