CVE-2023-50093

APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection...

CVE-2023-39655

A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions = 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thu...

CVE-2023-50093

APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection...

PT-2024-13858 · Broadcom · Apiida Api Gateway Manager

Name of the Vulnerable Software and Affected Versions: APIIDA API Gateway Manager for Broadcom Layer7 version 2023.2.2 Description: The APIIDA API Gateway Manager for Broadcom Layer7 is vulnerable to Host Header Injection. This issue allows an attacker to manipulate the Host header, potentially...

CVE-2023-39655

The CVE-2023-39655 issue concerns the NPM package @perfood/couch-auth (versions

APIIDA API Gateway Manager Security Vulnerability

APIIDA API Gateway Manager for Broadcom Layer7 is an APIIDA API gateway manager for Broadcom Layer7 from APIIDA Germany. It enables fast and reliable API deployment and migration as well as comprehensive API monitoring and alerting. A security vulnerability exists in APIIDA API Gateway Manager...

PT-2024-12818 · Npm · @Perfood/Couch-Auth

Name of the Vulnerable Software and Affected Versions: @perfood/couch-auth versions = 0.20.0 Description: A host header injection issue exists in the NPM package @perfood/couch-auth. By sending a specially crafted host header in the forgot password request, it is possible to send password reset...

CVE-2023-50093

CVE-2023-50093 affects APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 and is a Host Header Injection vulnerability. The Red Hat, NVD, and CVE listings corroborate a host header issue in APIIDA API Gateway Manager for Broadcom Layer7 2023.2.2. The issue stems from an injection vulnerabil...

Building an AppSec Program with Qualys WAS – Additional Configurations and Review & Confirm

Part 4 - Configuring a Web Application or API: Additional Configurations Now that we have completed the basic information, crawl settings, and default scan configurations, we can shift our attention to additional configurations designed to optimize scanning and provide granular control over how...

Shopify: HTTP Response Header Injection in shopify/pitchfork + Rack 3

The HTTP response header injection vulnerability was discovered in the Pitchfork library version 0.10.0 when used with Rack 3. The issue stemmed from improper handling of header values containing newline characters in the appendheader method of the HTTP response module. When Rack 3 was used, the...

Security Bulletin: IBM Cloud Pak for Data Scheduling was built with a vulnerable golang compiler. ( CVE-2023-29406, CVE-2023-29409 )

Summary Golang compiler is used by IBM Cloud Pak for Data Scheduling to build the scheduler binaries. Vulnerability Details CVEID:CVE-2023-29406 DESCRIPTION: Golang Go is vulnerable to HTTP header injection, caused by improper contents validation of Host header by the HTTP/1 client. By persuading...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Host Header Injection

zitadel is vulnerable to Host Header Injection attack. The vulnerability is caused due to improper validation of the X-Forwarded-Host header while creating a password reset link. An attacker can phish a user by tampering with X-Forwarded-Host header, retrieve the secret code which can be used to...

CVE-2023-49097 ZITADEL vulnerable account takeover via malicious host header injection

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicio...

GHSA-2WMJ-46RJ-QM2W ZITADEL Account Takeover via Malicious Host Header Injection

Impact ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code c...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to HTTP header injection due to [CVE-2023-29406]

Summary Golang Go is used by IBM App Connect Enterprise Certified Container in the operator catalog, the operator and its operands. The IBM App Connect Enterprise Certified Container operator and the IntegrationServer & IntegrationRuntime operands are vulnerable to HTTP header injection leading t...

Oracle Linux 8 : container-tools:4.0 (ELSA-2023-7202)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7202 advisory. - rebuild for CVE-2023-29406 - rebuild for CVE-2023-29406 - rebuild because of CVE-2023-29406 Tenable has extracted the preceding description block directly fro...

Jorani Leave Management System 1.0.2 Host Header Injection

Exploit Title: Jorani Leave Management System v1.0.2 Host Header Attack Date: 12/11/2023 Exploit Author: BugsBD Security Researcher Rahad Chowdhury Vendor Homepage: https://jorani.org/ Software Link: https://github.com/bbalet/jorani/releases/download/v1.0.2/jorani-1.0.2.zip Version: v1.0.2 Tested...

Jorani Security Breach

Jorani is a leave management system developed by Benjamin BALET, an individual developer in France. It is designed to provide small organizations with a simple workflow for leave and overtime requests. A security vulnerability exists in Jorani version 1.0.2, which stems from the presence of a hos...

golang: net/http: insufficient sanitization of Host header

A flaw was found in Golang, where it is vulnerable to HTTP header injection caused by improper content validation of the Host header by the HTTP/1 client. A remote attacker can inject arbitrary HTTP headers by persuading a victim to visit a specially crafted Web page. This flaw allows the attacke...