Security Bulletin: IBM Spectrum Copy Data Management is vulnerable to Slowloris, HTTP header injection, XSS, and CSRF (CVE-2022-22354, CVE-2022-22344, CVE-2021-39055, CVE-2021-39051)

Summary IBM Spectrum Copy Data Management is vulnerable to Slowloris HTTP denial of service, HTTP header injection, cross-site scripting XSS, and server-side request forgery CSRF attacks. Vulnerability Details CVEID: CVE-2022-22354 DESCRIPTION: IBM Spectrum Protect Plus and IBM Spectrum Copy Data...

HTTP Header Injection

stanford-corenlp is vulnerable to HTTP header injection. The addResults function of NERServlet.java does not properly validate the data in an HTTP response, allowing an attacker to inject malicious headers in requests...

Mageia: Security Advisory (MGASA-2017-0325)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2016-0230)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM Cloud Pak for Automation Input Validation Error Vulnerability

IBM Cloud Pak for Automation is an intelligent software platform for building automation applications in cloud environments from IBM USA. The platform uses pre-integrated automation technologies and low-code tools to design, build and run automation applications and services on any cloud. A...

CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP...

CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP...

CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 – Business Automation Studio component is vulnerable to HTTP header injection due to improper HOST header validation. A remote attacker can craft requests to inject the HOST header, enabling attacks such as cross-site scripting, cache poisoning, or s...

CVE-2021-29872: Improper Encoding or Escaping of Output

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP...

Security Bulletin: Host header injection vulnerability in Business Automation Studio in Cloud Pak for Automation (CVE-2021-29872)

Summary Business Automation Studio in IBM Cloud Pak for Automation is vulnerable to a host header injection attack. Vulnerability Details CVEID: CVE-2021-29872 DESCRIPTION: IBM ICP4A - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of...

Log4Shell HTTP Header Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Log4Shell HTTP Header Injection', 'Description' = %q Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in...

openSUSE 15 Security Update : netdata (openSUSE-SU-2021:1603-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1603-1 advisory. - An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data i...

Header injection in nodemailer

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object...

OrbiTeam BSCW Server XSS / LFI / User Enumeration

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities in BSCW Server product: OrbiTeam BSCW Server vulnerable version: BSCW Server 5.0.x, 5.1.x, =5.2.4, =7.3.x, =7.4.3 fixed version: 5.2.5, 7.4.4 CVE...

GitHub Security Lab: [Python]: CWE-079: HTTP Header injection

This bug was reported directly to GitHub Security Lab...

USN-5128-1: Ceph vulnerabilities

Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain environments. An attacker could use this to gain unintended access to resources. This issue only affected Ubuntu 18.04 LTS. CVE-2020-27781 It was discovered that Ceph...

Ubuntu 18.04 LTS : Ceph vulnerabilities (USN-5128-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5128-1 advisory. Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain environments. An attacker cou...

CVE-2021-20802

HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product...

CVE-2021-20802

HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product...

CVE-2021-20802

CVE-2021-20802 affects Cybozu Remote Service versions 3.1.8–3.1.9 and is an HTTP header injection vulnerability (CWE-113) that can let a remote attacker alter information stored in the product. The issue is documented across multiple sources (NVD, JVN, Red Hat, CNVD, CNVD, etc.). The confirmed im...