Google Go Denial of Service Vulnerability (CNVD-2017-32897)

Google Go is a programming language optimized for programming applications on multiprocessor systems by Google. A security vulnerability exists in the net/http inventory of the net/http/transfer.go file in versions of Google Go prior to 1.4.3, which stems from the program's failure to properly...

Cross site scripting

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

CVE-2017-1503

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

CVE-2017-1503

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

CVE-2017-1503: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perfor...

PT-2017-13823

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue allows a remote attacker to perform HTTP response splitting attacks by using a specially-crafted URL. Once the URL is clicked, the server returns a split response,...

CVE-2014-6106

Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via unknown vectors...

CVE-2014-6106: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via unknown vectors...

PT-2017-5964

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Manager versions 5.1 through 7.0 Description: A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests, potentially leading to cross-site scripting attacks, web cache...

CVE-2014-9564

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

Crlf injection

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

CVE-2014-9564

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

CVE-2014-9564

IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware (versions up to 3.4.1110 and earlier) is affected by two vulnerabilities mapped to CVE-2014-9564 (CRLF injection leading to HTTP response splitting, Web cache poisoning and potentially XSS) and CVE-2014-9565 (CSRF/XSS-r...

CVE-2014-9564: Improper Neutralization of CRLF Sequences

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

PT-2017-6364

Name of the Vulnerable Software and Affected Versions IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware versions prior to 3.4.1110 Description The issue allows remote attackers to inject arbitrary HTTP headers, which can lead to HTTP response splitting attacks. This...

Discourse: CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)

Hi, I noticed this issue on one of your clients which was using CloudFlare in front of their Discourse. This is not affecting try.discourse.org but the same underlying issue can be seen there as well even though it's not exploitable on that specific domain. The TL;DR of issue is basically:...

AddToAny Share Buttons <= 1.7.14 - Conditional Host Header Injection

Plugin description: "AddToAny is the universal sharing platform, and AddToAny’s plugin is the most popular share plugin for WordPress, making sites social media ready since 2006." Active installs according to https://wordpress.org/plugins/add-to-any/: 400,000+ checked on 15. Aug 2017 It's possibl...

PT-2018-7169

Name of the Vulnerable Software and Affected Versions: Undertow affected versions not specified Description: A flaw was found in Undertow where the HTTP request line parsing code allowed invalid characters. This could be exploited, in conjunction with a proxy that also allowed these characters bu...

CVE-2017-1291

IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attack...