CVE-2024-36419: URL Redirection to Untrusted Site

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

SuiteCRM Security Breach

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions prior to 8.6.1 that stems from a host header injection when accessing the /legacy route directly...

PT-2026-92039

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.4.1 Description The curl httpclient.CurlAsyncHTTPClient class fails to reject carriage return r and line feed characters in request headers. This allows attackers to inject CRLF sequences into header values, enablin...

RHEL 6 : luci (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - plone: Header injection CVE-2015-7318 - Cross-site scripting XSS vulnerability in ZMI pages that use the...

RHEL 5 : luci (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - plone: Header injection CVE-2015-7318 - Cross-site scripting XSS vulnerability in ZMI pages that use the...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

Security Bulletin: IBM Observability with Instana (OnPrem) is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 273 Vulnerability Details CVEID:CVE-2021-32052 DESCRIPTION: Django is vulnerable to HTTP header injection, caused by improper validation of input in URLValidator. By persuading a victim to visit a...

BIT-ARTIFACTORY-2024-2248

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 SaaS and 7.84.7 Self-Hosted may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email...

OESA-2024-1643 skopeo security update

A command line utility that performs various operations on container images and image repositories Security Fixes: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1...

golang: net/http: insufficient sanitization of Host header

A flaw was found in Golang, where it is vulnerable to HTTP header injection caused by improper content validation of the Host header by the HTTP/1 client. A remote attacker can inject arbitrary HTTP headers by persuading a victim to visit a specially crafted Web page. This flaw allows the attacke...

Host Header Injection

amphp/http is vulnerable to Host Header Injection. The vulnerability is caused by improper validation of newline characters in the Host header, allowing an attacker to inject arbitrary Hosts into the request header...

OESA-2024-1582 skopeo security update

A command line utility that performs various operations on container images and image repositories Security Fixes: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1...

Monolog Header injection in NativeMailerHandler

A header injection vulnerability has been identified in the NativeMailerHandler of the Monolog library. This vulnerability may allow an attacker to manipulate email headers when log messages are sent via email...

amphp/http Host Header Injection vulnerability

amphp/http versions before 1.0.1 allows an attacker to supply invalid input in the Host header which may lead to various type of Host header injection attacks...

CVE-2024-2248

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 SaaS and 7.84.7 Self-Hosted may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email...

CVE-2024-2248 JFrog Artifactory Header Injection

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 SaaS and 7.84.7 Self-Hosted may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email...

CVE-2024-2248 JFrog Artifactory Header Injection

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 SaaS and 7.84.7 Self-Hosted may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email...

CVE-2024-2248

CVE-2024-2248 is a header injection vulnerability in JFrog Platform affecting versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted). The issue could let an attacker take over a user’s account when a victim clicks a specially crafted URL sent to their email. The CVSS v3.1 base score is 6.4 (Medium...

amphp/http Host Header Injection vulnerability

amphp/http versions before 1.0.1 allows an attacker to supply invalid input in the Host header which may lead to various type of Host header injection attacks...

PT-2024-40203

Name of the Vulnerable Software and Affected Versions: amphp/http versions prior to 1.0.1 Description: The issue allows an attacker to supply invalid input in the Host header, which may lead to various types of Host header injection attacks. Recommendations: For versions prior to 1.0.1, update to...