CVE-2018-1474

MEDIUM Year: 2018
CVSS v3 Score
4.7
Medium
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-74
View all →

Vulnerability Description

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information. IBM X-force ID: 140692.

Related Vulnerabilities

CVE-2020-15187

MEDIUM
CVSS:4.7(Medium)

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an at...

CWE-742020

CVE-2020-4027

MEDIUM
CVSS:4.7(Medium)

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vuln...

CWE-742020

CVE-2023-30609

MEDIUM
CVSS:4.7(Medium)

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search resu...

CWE-742023

CVE-2024-11956

MEDIUM
CVSS:4.7(Medium)

A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanage...

CWE-742024

CVE-2024-28234

MEDIUM
CVSS:4.7(Medium)

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are onl...

CWE-742024

CVE-2025-1611

MEDIUM
CVSS:4.7(Medium)

A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. Th...

CWE-742025