Security Bulletin: Open Source Apache Tomcat vulnerability (CVE-2014-0227)

Summary Apache Tomcat is vulnerable to HTTP request smuggling. A remote attacker could send a specially-crafted request in a malformed chunked header to the Web server to cause multiple processing conflicts on the servers. An attacker could exploit this vulnerability to poison the web cache, bypa...

Security Bulletin: Open Source Apache Tomcat prior to 6.0.42 as used in IBM QRadar Security Information and Event Manager 7.1 MR2, and 7.2.4 is vulnerable to HTTP request smuggling. (CVE-2014-0227)

Summary Apache Tomcat prior to 6.0.43 is vulnerable to HTTP request smuggling. CVE-2014-0227 Vulnerability Details CVEID: CVE-2014-0227 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling. A remote attacker could send a specially-crafted request in a malformed chunked header to the...

Security Bulletin: IBM Security SiteProtector System is impacted by a vulnerability in Apache Tomcat (CVE-2014-0227)

Summary The IBM Security SiteProtector System uses Apache Tomcat, which is vulnerable to HTTP request smuggling. Vulnerability Details CVEID: CVE-2014-0227 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling. A remote attacker could send a specially-crafted request in a malformed...

Security Bulletin: IBM Cognos Business Intelligence Sever 2015Q2 Security Updater : IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 and IBM® Runtime Environment Java™ Technology Edition, Version 7 that are used by IBM Cognos Business Intelligence. These issues were disclosed as part of the IBM Java SDK updates in April...

Security Bulletin: Multiple Apache Tomcat vulnerabilities in IBM Algo Audit and Compliance (CVE-2013-4286, CVE-2013-4322, CVE-2013-4590, CVE-2014-0033)

Summary IBM Algo Audit and Compliance uses Apache Tomcat and is affected by multiple vulnerabilities identified in it, which could permit an attacker to compromise the web cache, bypass web application firewall protection and conduct XSS attacks, to cause a denial of service, to obtain sensitive...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server bundled with WebSphere Dynamic Process Edition

Summary WebSphere Business Modeler, WebSphere Integration Developer, WebSphere Business Services Fabric, WebSphere Process Server and WebSphere Business Monitor are shipped as components of WebSphere Dynamic Process Edition. WebSphere Application Server is the base for the server side products in...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with WebSphere Business Compass (CVE-2015-3183)

Summary IBM WebSphere Application Server WAS is shipped as a component of WebSphere Business Compass. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin Security...

Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerabilities (CVE-2014-0230, CVE-2014-7810,CVE-2014-0227)

Summary There are multiple vulnerabilities CVE-2014-0230, CVE-2014-7810,CVE-2014-0227 reported in Apache Tomcat v6 that is used by WebSphere Cast Iron Solution Vulnerability Details CVEID: CVE-2014-0230 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by missing limitations...

Eclipse Jetty CVE-2017-7656 Security Vulnerability

Description Eclipse Jetty is prone to a security vulnerability. An attacker can exploit this issue to conduct an HTTP request smuggling attack and perform unauthorized actions. This may lead to further attacks. Technologies Affected Eclipse Jetty 9.2.0 Eclipse Jetty 9.3.0 Eclipse Jetty 9.4.0 HP...

PT-2018-3781

Name of the Vulnerable Software and Affected Versions Eclipse Jetty Server versions 9.2.x and older Eclipse Jetty Server versions 9.3.x all non HTTP/1.x configurations Eclipse Jetty Server versions 9.4.x all HTTP/1.x configurations Description The issue is related to the implementation of the...

F5 Networks BIG-IP : Apache vulnerability (K00373024)

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-en...

Moderate: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R7 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

@architect/data (1.0.0), @architect/workflows (>=1.0.11, <=2.8.2) +23 more potentially affected by CVE-2018-1000096 via tiny-json-http (>=1.0.3, <=6.2.0)

tiny-json-http NPM version =1.0.3, =1.0.11, =3.0.0, =0.0.1, =1.1.5, =0.0.1, =3.0.0-beta.1, =0.17.717, =0.4.1-alpha.1, =0.4.1, =1.0.0-alpha.2 and more Source cves: CVE-2018-1000096 Source advisory: OSV:GHSA-7H42-5VJ2-CQ39...

RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2018:0005)

"The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0005 advisory. The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services AW...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7 (Important) (RHSA-2018:0004)

"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0004 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Re...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6 (Important) (RHSA-2018:0002)

"The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0002 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Re...

undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)

It was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the...

undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)

It was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.9 security update

An update is now available for Red Hat JBoss Enterprise Application Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.0 (RHSA-2017:3455)

"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3455 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Re...