httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir

It was found that Apache was vulnerable to a HTTP response splitting attack for sites which use moduserdir. An attacker could use this flaw to inject CRLF characters into the HTTP header and could possibly gain access to secure data...

CVE-2018-1549

IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the...

Cross site scripting

IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the...

CVE-2018-1549

IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the...

CVE-2018-1549

CVE-2018-1549 affects IBM Rational Quality Manager: vulnerable in RQM 5.0–5.0.2 and 6.0–6.0.5 due to HTTP response splitting. A remote attacker could craft a URL to trigger a split response, enabling web cache poisoning, cross-site scripting, and potential sensitive data exposure. Remediation per...

CVE-2018-1549: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the...

PT-2018-13053

Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager versions 5.0 through 5.0.2 IBM Rational Quality Manager versions 6.0 through 6.0.5 Description The issue allows a remote attacker to exploit the system using specially-crafted URLs, leading to HTTP response splitti...

Security Bulletin: IBM Cúram Universal Access V6.0.5.5 can be vulnerable to CRLF Injection attack (CVE-2014-3069)

Summary IBM Cúram Universal Access is vulnerable to CRLF Injection attack when not deployed on IBM WebSphere. Vulnerability Details CVE ID: CVE-2014-3069 DESCRIPTION: The Universal Access component of IBM Cúram Social Program Management, when not deployed on IBM WebSphere Application Server, is...

Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2016-6816, CVE-2016-6817, CVE-2016-8735 )

Summary Apache Tomcat vulnerability affects IBM Storwize V7000 Unified. Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2016-6816 DESCRIPTION: Apache...

Security Bulletin: Multiple Apache Tomcat vulnerabilities affect IBM SONAS.

Summary Multiple Apache Tomcat vulnerabilities affect IBM SONAS. Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2016-0762 DESCRIPTION: Apache Tomcat...

Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect IBM UrbanCode Release

Summary Multiple vulnerabilities in Apache Tomcat affect IBM UrbanCode Release Vulnerability Details CVEID: CVE-2016-6816 DESCRIPTION: Apache Tomcat is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this...

Security Bulletin: HTTP response splitting has been identified in IBM WebSphere Application Server Liberty Profile shipped with SmartCloud Cost Management and Tivoli Usage Accounting Manager (CVE-2015-2017)

Summary HTTP response splitting has been identified in IBM WebSphere Application Server Liberty Profile shipped with SmartCloud Cost Management and Tivoli Usage Accounting Manager CVE-2015-2017. Vulnerability Details CVEID: CVE-2015-2017 DESCRIPTION: The IBM WebSphere Application Server is...

Security Bulletin: A security vulnerability has been identified in IBM Business Process Manager, and bundling products shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise (CVE-2015-2017)

Summary A security vulnerability has been identified in IBM Business Process Manager, and bundling products shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise CVE-2015-2017 Vulnerability Details IBM Business Process Manager, IBM HTTP Server, IBM Tivoli System Automation...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core (CVE-2016-0359)

Summary IBM WebSphere Application Server v7.0 is shipped as a component of IBM Integrated Information Core. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin: HTTP...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core (CVE-2015-2017)

Summary IBM WebSphere Application Server v7.0 is shipped as a component of IBM Integrated Information Core. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin: HTTP...

Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management(JazzSM) Edge Caching Proxy may be vulnerable to HTTP response splitting (CVE-2017-1503)

Summary The Edge Caching Proxy component of WebSphere Application Server may be vulnerable to HTTP response splitting attack. This is a separate install from WebSphere Application Server. You only need to apply this if you use the Edge Caching Proxy. Vulnerability Details CVEID: CVE-2017-1503...

Security Bulletin: IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks (CVE-2017-1291)

Summary IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks. Vulnerability Details CVEID: CVE-2017-1291 DESCRIPTION: IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted UR...

Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM)

Summary Multiple vulnerabilities in Open Source Apache Tomcat reported by The Apache Software Foundation affect IBM Tivoli Application Dependency Discovery Manager Vulnerability Details CVEID: CVE-2016-0762 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information,...

Security Bulletin: IBM WebSphere Application Server Liberty Profile vulnerability affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2016-0359)

Summary WebSphere Application Server Liberty Profile that is embedded in TADDM is potentially vulnerable to HTTP response splitting Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker could...

Security Bulletin: Vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Network Manager IP Edition

Summary Websphere Application Server WAS is shipped as a component IBM Tivoli Network Manager IP Edition. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Please consult following security bulletins in WebSphere Application...